Edit tour

Windows Analysis Report
uwa78qqv0x.exe

Overview

General Information

Sample name:	uwa78qqv0x.exe renamed because original name is a hash value
Original sample name:	1f26197a5239abd7c93b7dc95c79f102.exe
Analysis ID:	1579670
MD5:	1f26197a5239abd7c93b7dc95c79f102
SHA1:	68849610394a573c7ed15ba0cd9200f10de9b435
SHA256:	d9be895942e95e3c06b9295b1aaabe89d5ba4a1e5e33ccdb2efec7806cd216a1
Tags:	exeuser-abuse_ch
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Entry point lies outside standard sections

Found large amount of non-executed APIs

HTTP GET or POST without a user agent

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Classification

Process Tree

System is w10x64

uwa78qqv0x.exe (PID: 7616 cmdline: "C:\Users\user\Desktop\uwa78qqv0x.exe" MD5: 1F26197A5239ABD7C93B7DC95C79F102)

WerFault.exe (PID: 7884 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7616 -s 1136 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: uwa78qqv0x.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: uwa78qqv0x.exe	ReversingLabs: Detection: 65%
Source: uwa78qqv0x.exe	Virustotal: Detection: 47%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: uwa78qqv0x.exe

Joe Sandbox ML: detected

Source: uwa78qqv0x.exe, 00000000.00000003.1435204736.0000000007416000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_fde7ac0d-4

Source: uwa78qqv0x.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: global traffic

HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: */*

Source: Joe Sandbox View

IP Address: 98.85.100.80 98.85.100.80

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: */*

Source: global traffic	DNS traffic detected: DNS query: httpbin.org
Source: global traffic	DNS traffic detected: DNS query: home.fivetk5ht.top

Source: uwa78qqv0x.exe, 00000000.00000003.1435204736.0000000007416000.00000004.00001000.00020000.00000000.sdmp, uwa78qqv0x.exe, 00000000.00000002.1632765897.00000000014BD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://.css
Source: uwa78qqv0x.exe, 00000000.00000003.1435204736.0000000007416000.00000004.00001000.00020000.00000000.sdmp, uwa78qqv0x.exe, 00000000.00000002.1632765897.00000000014BD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://.jpg
Source: uwa78qqv0x.exe, 00000000.00000002.1632765897.00000000014BD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv17
Source: uwa78qqv0x.exe, 00000000.00000002.1632765897.00000000014BD000.00000040.00000001.01000000.00000003.sdmp, uwa78qqv0x.exe, 00000000.00000002.1632599745.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, uwa78qqv0x.exe, 00000000.00000002.1632599745.0000000000A0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851
Source: uwa78qqv0x.exe, 00000000.00000002.1632599745.00000000009AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv17345798516963
Source: uwa78qqv0x.exe, 00000000.00000002.1632765897.00000000014BD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851http://home.fivetk5ht.top/zldPRFrmVFHTtKntGp
Source: uwa78qqv0x.exe, 00000000.00000002.1632599745.0000000000A0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851l
Source: uwa78qqv0x.exe, 00000000.00000003.1435204736.0000000007416000.00000004.00001000.00020000.00000000.sdmp, uwa78qqv0x.exe, 00000000.00000002.1632765897.00000000014BD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: Amcache.hve.4.dr	String found in binary or memory: http://upx.sf.net
Source: uwa78qqv0x.exe, 00000000.00000002.1632765897.00000000014BD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: uwa78qqv0x.exe, 00000000.00000002.1632765897.00000000014BD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: uwa78qqv0x.exe, 00000000.00000003.1435204736.0000000007416000.00000004.00001000.00020000.00000000.sdmp, uwa78qqv0x.exe, 00000000.00000002.1632765897.00000000014BD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: uwa78qqv0x.exe, 00000000.00000003.1435204736.0000000007416000.00000004.00001000.00020000.00000000.sdmp, uwa78qqv0x.exe, 00000000.00000002.1632765897.00000000014BD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://httpbin.org/ip
Source: uwa78qqv0x.exe, 00000000.00000003.1435204736.0000000007416000.00000004.00001000.00020000.00000000.sdmp, uwa78qqv0x.exe, 00000000.00000002.1632765897.00000000014BD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://httpbin.org/ipbefore

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705

System Summary

PE file contains section with special chars

Source: uwa78qqv0x.exe	Static PE information: section name:
Source: uwa78qqv0x.exe	Static PE information: section name: .idata
Source: uwa78qqv0x.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\uwa78qqv0x.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7616 -s 1136

Source: uwa78qqv0x.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: uwa78qqv0x.exe

Static PE information: Section: gzrpzaat ZLIB complexity 0.9942267842090475

Source: classification engine

Classification label: mal100.evad.winEXE@2/5@14/1

Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Mutant created: \Sessions\1\BaseNamedObjects\My_mutex
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7616

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\357d52ea-40e0-490f-9c4d-fcc692f84ab3

Jump to behavior

Source: C:\Users\user\Desktop\uwa78qqv0x.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\uwa78qqv0x.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: uwa78qqv0x.exe	ReversingLabs: Detection: 65%
Source: uwa78qqv0x.exe	Virustotal: Detection: 47%

Source: uwa78qqv0x.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\uwa78qqv0x.exe "C:\Users\user\Desktop\uwa78qqv0x.exe"
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7616 -s 1136

Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Section loaded: winrnr.dll	Jump to behavior

Source: uwa78qqv0x.exe

Static file information: File size 4478464 > 1048576

Source: uwa78qqv0x.exe	Static PE information: Raw size of is bigger than: 0x100000 < 0x284c00
Source: uwa78qqv0x.exe	Static PE information: Raw size of gzrpzaat is bigger than: 0x100000 < 0x1bce00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\uwa78qqv0x.exe

Unpacked PE file: 0.2.uwa78qqv0x.exe.ee0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;gzrpzaat:EW;usdkjmbf:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;gzrpzaat:EW;usdkjmbf:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: uwa78qqv0x.exe

Static PE information: real checksum: 0x453c80 should be: 0x448b2d

Source: uwa78qqv0x.exe	Static PE information: section name:
Source: uwa78qqv0x.exe	Static PE information: section name: .idata
Source: uwa78qqv0x.exe	Static PE information: section name:
Source: uwa78qqv0x.exe	Static PE information: section name: gzrpzaat
Source: uwa78qqv0x.exe	Static PE information: section name: usdkjmbf
Source: uwa78qqv0x.exe	Static PE information: section name: .taggant

Source: uwa78qqv0x.exe

Static PE information: section name: gzrpzaat entropy: 7.955149229409411

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\uwa78qqv0x.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: uwa78qqv0x.exe, 00000000.00000003.1435204736.0000000007416000.00000004.00001000.00020000.00000000.sdmp, uwa78qqv0x.exe, 00000000.00000002.1632765897.00000000014BD000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: PROCMON.EXE
Source: uwa78qqv0x.exe, 00000000.00000003.1435204736.0000000007416000.00000004.00001000.00020000.00000000.sdmp, uwa78qqv0x.exe, 00000000.00000002.1632765897.00000000014BD000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: X64DBG.EXE
Source: uwa78qqv0x.exe, 00000000.00000003.1435204736.0000000007416000.00000004.00001000.00020000.00000000.sdmp, uwa78qqv0x.exe, 00000000.00000002.1632765897.00000000014BD000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: WINDBG.EXE
Source: uwa78qqv0x.exe, 00000000.00000002.1632765897.00000000014BD000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: SYSINTERNALSNUM_PROCESSORNUM_RAMNAMEALLFREEDRIVERSNUM_DISPLAYSRESOLUTION_XRESOLUTION_Y\RECENT_FILESPROCESSESUPTIME_MINUTESC:\WINDOWS\SYSTEM32\VBOX.DLL01VBOX_FIRSTSYSTEM\CONTROLSET001\SERVICES\VBOXSFVBOX_SECONDC:\USERS\PUBLIC\PUBLIC_CHECKWINDBG.EXEDBGWIRESHARK.EXEPROCMON.EXEX64DBG.EXEIDA.EXEDBG_SECDBG_THIRDYADROINSTALLED_APPSSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALLSOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL%D%S\%SDISPLAYNAMEAPP_NAMEINDEXCREATETOOLHELP32SNAPSHOT FAILED.
Source: uwa78qqv0x.exe, 00000000.00000003.1435204736.0000000007416000.00000004.00001000.00020000.00000000.sdmp, uwa78qqv0x.exe, 00000000.00000002.1632765897.00000000014BD000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: WIRESHARK.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17AF52A second address: 17AF54D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F43D0D9C318h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17A92A2 second address: 17A92B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17AEB0B second address: 17AEB19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F43D0D9C306h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17AEB19 second address: 17AEB1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17AECB2 second address: 17AED33 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F43D0D9C30Fh 0x0000000e pushad 0x0000000f jmp 00007F43D0D9C30Ch 0x00000014 jmp 00007F43D0D9C311h 0x00000019 jmp 00007F43D0D9C317h 0x0000001e popad 0x0000001f pushad 0x00000020 jmp 00007F43D0D9C317h 0x00000025 jmp 00007F43D0D9C319h 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17AED33 second address: 17AED39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17B0FDC second address: 17B0FE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17B0FE2 second address: 17B1046 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ecx 0x0000000a call 00007F43D1015A28h 0x0000000f pop ecx 0x00000010 mov dword ptr [esp+04h], ecx 0x00000014 add dword ptr [esp+04h], 00000017h 0x0000001c inc ecx 0x0000001d push ecx 0x0000001e ret 0x0000001f pop ecx 0x00000020 ret 0x00000021 push 00000000h 0x00000023 or dword ptr [ebp+12A21DE0h], ecx 0x00000029 jmp 00007F43D1015A32h 0x0000002e call 00007F43D1015A29h 0x00000033 jo 00007F43D1015A45h 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007F43D1015A33h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17B1046 second address: 17B104A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17B104A second address: 17B105A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007F43D1015A26h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17B105A second address: 17B1087 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jp 00007F43D0D9C318h 0x00000015 mov eax, dword ptr [eax] 0x00000017 push esi 0x00000018 push ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17B1087 second address: 17B1109 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop esi 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a jg 00007F43D1015A2Ah 0x00000010 push ecx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 pop ecx 0x00000014 pop eax 0x00000015 mov dword ptr [ebp+12A217B5h], eax 0x0000001b push 00000003h 0x0000001d cmc 0x0000001e call 00007F43D1015A39h 0x00000023 call 00007F43D1015A33h 0x00000028 cmc 0x00000029 pop esi 0x0000002a pop edi 0x0000002b push 00000000h 0x0000002d mov ecx, 4FA1CF1Eh 0x00000032 push 00000003h 0x00000034 pushad 0x00000035 movzx edi, cx 0x00000038 jmp 00007F43D1015A39h 0x0000003d popad 0x0000003e push E910FD87h 0x00000043 jo 00007F43D1015A30h 0x00000049 pushad 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17B119D second address: 17B11C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop ebx 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F43D0D9C318h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17B11C3 second address: 17B11DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F43D1015A34h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17B11DB second address: 17B128A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov edi, 0F5A9400h 0x0000000e push 00000000h 0x00000010 cld 0x00000011 call 00007F43D0D9C309h 0x00000016 pushad 0x00000017 jmp 00007F43D0D9C316h 0x0000001c jmp 00007F43D0D9C319h 0x00000021 popad 0x00000022 push eax 0x00000023 jmp 00007F43D0D9C318h 0x00000028 mov eax, dword ptr [esp+04h] 0x0000002c jmp 00007F43D0D9C30Ch 0x00000031 mov eax, dword ptr [eax] 0x00000033 jmp 00007F43D0D9C314h 0x00000038 mov dword ptr [esp+04h], eax 0x0000003c pushad 0x0000003d jnc 00007F43D0D9C30Ch 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007F43D0D9C312h 0x0000004a rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17B128A second address: 17B128E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17B128E second address: 17B12DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop eax 0x00000008 push 00000003h 0x0000000a sub dword ptr [ebp+12A217B5h], eax 0x00000010 push 00000000h 0x00000012 push 00000003h 0x00000014 push 00000000h 0x00000016 push edx 0x00000017 call 00007F43D0D9C308h 0x0000001c pop edx 0x0000001d mov dword ptr [esp+04h], edx 0x00000021 add dword ptr [esp+04h], 00000015h 0x00000029 inc edx 0x0000002a push edx 0x0000002b ret 0x0000002c pop edx 0x0000002d ret 0x0000002e call 00007F43D0D9C309h 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007F43D0D9C311h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17B12DB second address: 17B12F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F43D1015A26h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 push esi 0x00000011 push eax 0x00000012 pop eax 0x00000013 pop esi 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17B12F2 second address: 17B1306 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007F43D0D9C306h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17B1306 second address: 17B130C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17B130C second address: 17B1338 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D0D9C311h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c jmp 00007F43D0D9C30Fh 0x00000011 pushad 0x00000012 push esi 0x00000013 pop esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17B1338 second address: 17B1347 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17B1347 second address: 17B134C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17B134C second address: 17B1352 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17D1E7E second address: 17D1E9A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D0D9C315h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17CFCF4 second address: 17CFD1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jc 00007F43D1015A26h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jl 00007F43D1015A28h 0x00000014 pushad 0x00000015 popad 0x00000016 jl 00007F43D1015A30h 0x0000001c jmp 00007F43D1015A2Ah 0x00000021 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17D0183 second address: 17D0189 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17D0189 second address: 17D018D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17D02BC second address: 17D02CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007F43D0D9C306h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17D02CC second address: 17D02FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F43D1015A38h 0x0000000e push eax 0x0000000f push edx 0x00000010 jng 00007F43D1015A26h 0x00000016 jno 00007F43D1015A26h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17D02FB second address: 17D02FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17D02FF second address: 17D0305 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17D0711 second address: 17D0734 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F43D0D9C318h 0x00000009 je 00007F43D0D9C306h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17D08BE second address: 17D08C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17D08C4 second address: 17D08E9 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F43D0D9C306h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F43D0D9C317h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17D08E9 second address: 17D08ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17D0B9C second address: 17D0BB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F43D0D9C318h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17D0BB8 second address: 17D0BCE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D1015A32h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17D0D37 second address: 17D0D3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17D0D3E second address: 17D0D51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F43D1015A2Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17D0EB9 second address: 17D0EBF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17C70E4 second address: 17C70EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17C70EA second address: 17C70F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17D1795 second address: 17D1799 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17D1799 second address: 17D17C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F43D0D9C317h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jo 00007F43D0D9C306h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17D17C0 second address: 17D17CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17D4CB8 second address: 17D4CC6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F43D0D9C306h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17D4CC6 second address: 17D4CCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17D6CE1 second address: 17D6CE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17D6CE5 second address: 17D6CF3 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F43D1015A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17D6CF3 second address: 17D6CF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17DD783 second address: 17DD7CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jnp 00007F43D1015A26h 0x0000000c popad 0x0000000d push esi 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 pop esi 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jc 00007F43D1015A3Bh 0x0000001c jmp 00007F43D1015A35h 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F43D1015A36h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17DD7CC second address: 17DD7D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17DD7D0 second address: 17DD7D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17DDBF0 second address: 17DDC10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F43D0D9C319h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17DDC10 second address: 17DDC28 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F43D1015A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jng 00007F43D1015A32h 0x00000010 jg 00007F43D1015A26h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17DDDBB second address: 17DDDBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17DDDBF second address: 17DDDC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17E059A second address: 17E05C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xor dword ptr [esp], 06FE501Bh 0x0000000e movsx esi, ax 0x00000011 push C0F417E8h 0x00000016 push eax 0x00000017 push edx 0x00000018 jns 00007F43D0D9C311h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17E05C3 second address: 17E05CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17E0716 second address: 17E071C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17E071C second address: 17E0720 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17E08A0 second address: 17E08AA instructions: 0x00000000 rdtsc 0x00000002 jng 00007F43D0D9C306h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17E10ED second address: 17E10F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17E10F1 second address: 17E1169 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F43D0D9C30Fh 0x0000000c jns 00007F43D0D9C306h 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 jo 00007F43D0D9C321h 0x0000001b pushad 0x0000001c jp 00007F43D0D9C306h 0x00000022 jmp 00007F43D0D9C313h 0x00000027 popad 0x00000028 xchg eax, ebx 0x00000029 push 00000000h 0x0000002b push edi 0x0000002c call 00007F43D0D9C308h 0x00000031 pop edi 0x00000032 mov dword ptr [esp+04h], edi 0x00000036 add dword ptr [esp+04h], 00000018h 0x0000003e inc edi 0x0000003f push edi 0x00000040 ret 0x00000041 pop edi 0x00000042 ret 0x00000043 xor dword ptr [ebp+12A21ECCh], esi 0x00000049 mov dword ptr [ebp+12A21C76h], ebx 0x0000004f push eax 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 js 00007F43D0D9C306h 0x0000005a rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17E1169 second address: 17E1173 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F43D1015A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17E12B3 second address: 17E12BD instructions: 0x00000000 rdtsc 0x00000002 jp 00007F43D0D9C306h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17E15BC second address: 17E15C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17E1678 second address: 17E1682 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F43D0D9C30Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17E16D4 second address: 17E1709 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F43D1015A26h 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 mov di, 3B1Ah 0x00000015 xchg eax, ebx 0x00000016 pushad 0x00000017 jmp 00007F43D1015A2Ch 0x0000001c push edi 0x0000001d push edx 0x0000001e pop edx 0x0000001f pop edi 0x00000020 popad 0x00000021 push eax 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F43D1015A2Ah 0x00000029 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17E1709 second address: 17E171E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F43D0D9C310h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17E1BE9 second address: 17E1BFA instructions: 0x00000000 rdtsc 0x00000002 jng 00007F43D1015A28h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17E24B4 second address: 17E24B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17E24B9 second address: 17E24C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F43D1015A26h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17E3579 second address: 17E357D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17E3F99 second address: 17E3FAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F43D1015A2Fh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17E3FAF second address: 17E4044 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F43D0D9C306h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007F43D0D9C308h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 00000017h 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push eax 0x0000002d call 00007F43D0D9C308h 0x00000032 pop eax 0x00000033 mov dword ptr [esp+04h], eax 0x00000037 add dword ptr [esp+04h], 0000001Dh 0x0000003f inc eax 0x00000040 push eax 0x00000041 ret 0x00000042 pop eax 0x00000043 ret 0x00000044 mov esi, dword ptr [ebp+12A22B8Dh] 0x0000004a push 00000000h 0x0000004c push 00000000h 0x0000004e push esi 0x0000004f call 00007F43D0D9C308h 0x00000054 pop esi 0x00000055 mov dword ptr [esp+04h], esi 0x00000059 add dword ptr [esp+04h], 00000017h 0x00000061 inc esi 0x00000062 push esi 0x00000063 ret 0x00000064 pop esi 0x00000065 ret 0x00000066 mov dword ptr [ebp+12A21F56h], eax 0x0000006c mov esi, 48BB14A3h 0x00000071 push eax 0x00000072 push eax 0x00000073 push edx 0x00000074 jl 00007F43D0D9C30Ch 0x0000007a ja 00007F43D0D9C306h 0x00000080 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17E4044 second address: 17E4049 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17E4A9C second address: 17E4AA2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17E4AA2 second address: 17E4AA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17E4AA8 second address: 17E4AAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17E4AAC second address: 17E4B12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b jl 00007F43D1015A2Ch 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ecx 0x00000016 call 00007F43D1015A28h 0x0000001b pop ecx 0x0000001c mov dword ptr [esp+04h], ecx 0x00000020 add dword ptr [esp+04h], 0000001Ch 0x00000028 inc ecx 0x00000029 push ecx 0x0000002a ret 0x0000002b pop ecx 0x0000002c ret 0x0000002d mov edi, 6B134D87h 0x00000032 push 00000000h 0x00000034 stc 0x00000035 xchg eax, ebx 0x00000036 jp 00007F43D1015A46h 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F43D1015A38h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17E5538 second address: 17E55BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D0D9C318h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push edi 0x0000000c push esi 0x0000000d pop esi 0x0000000e pop edi 0x0000000f pushad 0x00000010 push edi 0x00000011 pop edi 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 popad 0x00000015 popad 0x00000016 nop 0x00000017 mov edi, 57B4369Fh 0x0000001c push 00000000h 0x0000001e pushad 0x0000001f jns 00007F43D0D9C308h 0x00000025 jnl 00007F43D0D9C31Eh 0x0000002b popad 0x0000002c push 00000000h 0x0000002e push edi 0x0000002f sub edi, dword ptr [ebp+12A22AB9h] 0x00000035 pop esi 0x00000036 xchg eax, ebx 0x00000037 jp 00007F43D0D9C315h 0x0000003d push eax 0x0000003e pushad 0x0000003f push eax 0x00000040 push edx 0x00000041 jp 00007F43D0D9C306h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17E55BB second address: 17E55BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17E8895 second address: 17E88CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F43D0D9C318h 0x00000009 jmp 00007F43D0D9C315h 0x0000000e popad 0x0000000f pop edi 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17E88CD second address: 17E88EB instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F43D1015A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b pushad 0x0000000c popad 0x0000000d jg 00007F43D1015A26h 0x00000013 pop esi 0x00000014 je 00007F43D1015A2Eh 0x0000001a push edi 0x0000001b pop edi 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17EAFFB second address: 17EB09C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jbe 00007F43D0D9C313h 0x0000000f jmp 00007F43D0D9C30Dh 0x00000014 nop 0x00000015 pushad 0x00000016 jne 00007F43D0D9C30Bh 0x0000001c popad 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push ebp 0x00000022 call 00007F43D0D9C308h 0x00000027 pop ebp 0x00000028 mov dword ptr [esp+04h], ebp 0x0000002c add dword ptr [esp+04h], 00000019h 0x00000034 inc ebp 0x00000035 push ebp 0x00000036 ret 0x00000037 pop ebp 0x00000038 ret 0x00000039 and bh, FFFFFFECh 0x0000003c push 00000000h 0x0000003e push 00000000h 0x00000040 push ebp 0x00000041 call 00007F43D0D9C308h 0x00000046 pop ebp 0x00000047 mov dword ptr [esp+04h], ebp 0x0000004b add dword ptr [esp+04h], 0000001Bh 0x00000053 inc ebp 0x00000054 push ebp 0x00000055 ret 0x00000056 pop ebp 0x00000057 ret 0x00000058 sub dword ptr [ebp+12A22388h], ecx 0x0000005e jmp 00007F43D0D9C30Dh 0x00000063 xchg eax, esi 0x00000064 push edi 0x00000065 push eax 0x00000066 push edx 0x00000067 jmp 00007F43D0D9C315h 0x0000006c rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17EB09C second address: 17EB0A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17EB0A0 second address: 17EB0C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F43D0D9C318h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17ED02C second address: 17ED04C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D1015A36h 0x00000007 jo 00007F43D1015A26h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17EB229 second address: 17EB247 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F43D0D9C313h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17EB247 second address: 17EB2F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F43D1015A33h 0x00000008 jmp 00007F43D1015A36h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007F43D1015A28h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 00000014h 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b push dword ptr fs:[00000000h] 0x00000032 mov ebx, edx 0x00000034 mov dword ptr fs:[00000000h], esp 0x0000003b sub dword ptr [ebp+12A21F9Ch], edi 0x00000041 mov eax, dword ptr [ebp+12A2162Dh] 0x00000047 push 00000000h 0x00000049 push edi 0x0000004a call 00007F43D1015A28h 0x0000004f pop edi 0x00000050 mov dword ptr [esp+04h], edi 0x00000054 add dword ptr [esp+04h], 00000014h 0x0000005c inc edi 0x0000005d push edi 0x0000005e ret 0x0000005f pop edi 0x00000060 ret 0x00000061 mov dword ptr [ebp+12A21F6Bh], ecx 0x00000067 push FFFFFFFFh 0x00000069 push ebx 0x0000006a mov ebx, 713C0D3Ch 0x0000006f pop ebx 0x00000070 nop 0x00000071 pushad 0x00000072 push edi 0x00000073 jmp 00007F43D1015A2Fh 0x00000078 pop edi 0x00000079 push edx 0x0000007a push eax 0x0000007b push edx 0x0000007c rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17ED816 second address: 17ED81A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17ED81A second address: 17ED8AD instructions: 0x00000000 rdtsc 0x00000002 je 00007F43D1015A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c ja 00007F43D1015A39h 0x00000012 nop 0x00000013 mov di, dx 0x00000016 mov bx, 8787h 0x0000001a push dword ptr fs:[00000000h] 0x00000021 mov ebx, edx 0x00000023 mov dword ptr fs:[00000000h], esp 0x0000002a mov bx, 5B5Fh 0x0000002e xor ebx, dword ptr [ebp+12A231CEh] 0x00000034 mov eax, dword ptr [ebp+12A2111Dh] 0x0000003a and edi, dword ptr [ebp+12A228D1h] 0x00000040 push FFFFFFFFh 0x00000042 push 00000000h 0x00000044 push edi 0x00000045 call 00007F43D1015A28h 0x0000004a pop edi 0x0000004b mov dword ptr [esp+04h], edi 0x0000004f add dword ptr [esp+04h], 00000019h 0x00000057 inc edi 0x00000058 push edi 0x00000059 ret 0x0000005a pop edi 0x0000005b ret 0x0000005c mov ebx, dword ptr [ebp+12A21FA8h] 0x00000062 jmp 00007F43D1015A32h 0x00000067 nop 0x00000068 push ebx 0x00000069 push eax 0x0000006a push eax 0x0000006b push edx 0x0000006c rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17F0526 second address: 17F0573 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F43D0D9C315h 0x0000000a jmp 00007F43D0D9C317h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jmp 00007F43D0D9C30Fh 0x00000018 jg 00007F43D0D9C306h 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17EE804 second address: 17EE81E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D1015A32h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17F1CD5 second address: 17F1CDF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17F0D1A second address: 17F0D1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17F1CDF second address: 17F1CE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17F0D1E second address: 17F0D31 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D1015A2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17F4D65 second address: 17F4DD1 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F43D0D9C308h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push esi 0x0000000e call 00007F43D0D9C308h 0x00000013 pop esi 0x00000014 mov dword ptr [esp+04h], esi 0x00000018 add dword ptr [esp+04h], 00000014h 0x00000020 inc esi 0x00000021 push esi 0x00000022 ret 0x00000023 pop esi 0x00000024 ret 0x00000025 mov di, 2821h 0x00000029 mov bx, F754h 0x0000002d push 00000000h 0x0000002f xor ebx, 7E22EE7Ah 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push ebp 0x0000003a call 00007F43D0D9C308h 0x0000003f pop ebp 0x00000040 mov dword ptr [esp+04h], ebp 0x00000044 add dword ptr [esp+04h], 0000001Dh 0x0000004c inc ebp 0x0000004d push ebp 0x0000004e ret 0x0000004f pop ebp 0x00000050 ret 0x00000051 xor ebx, dword ptr [ebp+12A22294h] 0x00000057 push eax 0x00000058 push eax 0x00000059 push edx 0x0000005a push edi 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17F4DD1 second address: 17F4DD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17F3F1D second address: 17F3F21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17F3F21 second address: 17F3FAA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ecx 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d jmp 00007F43D1015A2Bh 0x00000012 pop eax 0x00000013 nop 0x00000014 mov edi, dword ptr [ebp+12A21EC3h] 0x0000001a mov bh, 37h 0x0000001c push dword ptr fs:[00000000h] 0x00000023 sub dword ptr [ebp+12A21ECCh], ebx 0x00000029 mov dword ptr fs:[00000000h], esp 0x00000030 jns 00007F43D1015A2Ch 0x00000036 mov ebx, dword ptr [ebp+12A21C76h] 0x0000003c mov eax, dword ptr [ebp+12A211A9h] 0x00000042 push 00000000h 0x00000044 push ebx 0x00000045 call 00007F43D1015A28h 0x0000004a pop ebx 0x0000004b mov dword ptr [esp+04h], ebx 0x0000004f add dword ptr [esp+04h], 00000018h 0x00000057 inc ebx 0x00000058 push ebx 0x00000059 ret 0x0000005a pop ebx 0x0000005b ret 0x0000005c push FFFFFFFFh 0x0000005e jmp 00007F43D1015A39h 0x00000063 nop 0x00000064 push eax 0x00000065 push edx 0x00000066 push eax 0x00000067 push eax 0x00000068 push edx 0x00000069 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17F3FAA second address: 17F3FAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17F4F09 second address: 17F4F17 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F43D1015A26h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17F4F17 second address: 17F4F1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17F7BD5 second address: 17F7BDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17F7BDA second address: 17F7C38 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F43D0D9C31Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d sbb bx, 9FB9h 0x00000012 push 00000000h 0x00000014 mov ebx, 56D98BBDh 0x00000019 pushad 0x0000001a mov ax, di 0x0000001d popad 0x0000001e push 00000000h 0x00000020 call 00007F43D0D9C318h 0x00000025 mov ebx, dword ptr [ebp+12A22BEDh] 0x0000002b pop ebx 0x0000002c push eax 0x0000002d pushad 0x0000002e pushad 0x0000002f push edi 0x00000030 pop edi 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17F9C75 second address: 17F9C7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F43D1015A26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17F9C7F second address: 17F9C85 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17F9C85 second address: 17F9CA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D1015A32h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17F9CA0 second address: 17F9CBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jmp 00007F43D0D9C30Fh 0x0000000d je 00007F43D0D9C312h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17F9CBF second address: 17F9CD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F43D1015A26h 0x0000000a push eax 0x0000000b push edx 0x0000000c jbe 00007F43D1015A26h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17F9CD3 second address: 17F9CD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17F9CD7 second address: 17F9CDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17F5E05 second address: 17F5E79 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F43D0D9C308h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007F43D0D9C308h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 push dword ptr fs:[00000000h] 0x0000002e mov dword ptr fs:[00000000h], esp 0x00000035 jmp 00007F43D0D9C30Bh 0x0000003a mov eax, dword ptr [ebp+12A208F5h] 0x00000040 mov ebx, dword ptr [ebp+12A21B9Fh] 0x00000046 push FFFFFFFFh 0x00000048 jl 00007F43D0D9C30Dh 0x0000004e jne 00007F43D0D9C307h 0x00000054 nop 0x00000055 push eax 0x00000056 push edx 0x00000057 jmp 00007F43D0D9C310h 0x0000005c rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17F6DEF second address: 17F6DF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17F5E79 second address: 17F5EA4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D0D9C30Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c jnc 00007F43D0D9C306h 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F43D0D9C311h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17F6DF9 second address: 17F6DFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17F6DFD second address: 17F6E01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17FA470 second address: 17FA508 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D1015A36h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push edx 0x00000010 call 00007F43D1015A28h 0x00000015 pop edx 0x00000016 mov dword ptr [esp+04h], edx 0x0000001a add dword ptr [esp+04h], 00000015h 0x00000022 inc edx 0x00000023 push edx 0x00000024 ret 0x00000025 pop edx 0x00000026 ret 0x00000027 push dword ptr fs:[00000000h] 0x0000002e movsx edi, bx 0x00000031 mov bx, DBA1h 0x00000035 mov dword ptr fs:[00000000h], esp 0x0000003c push 00000000h 0x0000003e push ebp 0x0000003f call 00007F43D1015A28h 0x00000044 pop ebp 0x00000045 mov dword ptr [esp+04h], ebp 0x00000049 add dword ptr [esp+04h], 0000001Dh 0x00000051 inc ebp 0x00000052 push ebp 0x00000053 ret 0x00000054 pop ebp 0x00000055 ret 0x00000056 jno 00007F43D1015A2Ch 0x0000005c mov eax, dword ptr [ebp+12A20F8Dh] 0x00000062 mov ebx, eax 0x00000064 push FFFFFFFFh 0x00000066 xor dword ptr [ebp+12A217CBh], edi 0x0000006c push eax 0x0000006d push eax 0x0000006e push edx 0x0000006f push eax 0x00000070 push edx 0x00000071 pushad 0x00000072 popad 0x00000073 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17FE462 second address: 17FE46C instructions: 0x00000000 rdtsc 0x00000002 jo 00007F43D0D9C306h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17FA508 second address: 17FA51D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D1015A31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17FE46C second address: 17FE472 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17FB54C second address: 17FB556 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F43D1015A2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 179698D second address: 17969CC instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F43D0D9C308h 0x00000008 push esi 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pop esi 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jmp 00007F43D0D9C30Ch 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 jp 00007F43D0D9C306h 0x0000001e popad 0x0000001f push edx 0x00000020 jmp 00007F43D0D9C313h 0x00000025 push ecx 0x00000026 pop ecx 0x00000027 pop edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17969CC second address: 17969D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17969D3 second address: 17969E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F43D0D9C30Bh 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17969E6 second address: 17969F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jnp 00007F43D1015A26h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1804DE3 second address: 1804DE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1804DE7 second address: 1804E03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F43D1015A2Dh 0x0000000c jne 00007F43D1015A26h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17A0B2D second address: 17A0B4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F43D0D9C317h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1808F10 second address: 1808F14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1808F14 second address: 1808F2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F43D0D9C313h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 18090B0 second address: 18090C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edx 0x00000006 jmp 00007F43D1015A2Bh 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 180E1BB second address: 180E1BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 180E1BF second address: 180E1C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 180E1C8 second address: 180E1D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 180E1D7 second address: 180E1DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1798525 second address: 1798529 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1812000 second address: 181201B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D1015A2Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d js 00007F43D1015A26h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 18125F1 second address: 181260B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F43D0D9C314h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 181260B second address: 1812610 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1812A5E second address: 1812A64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1812A64 second address: 1812A68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1812A68 second address: 1812A70 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1812A70 second address: 1812A75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1812A75 second address: 1812A7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1812A7B second address: 1812AC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jnc 00007F43D1015A2Ch 0x00000010 jmp 00007F43D1015A38h 0x00000015 jmp 00007F43D1015A2Bh 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d jmp 00007F43D1015A30h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1812D94 second address: 1812D9C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1812D9C second address: 1812DA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1812DA1 second address: 1812DB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c ja 00007F43D0D9C312h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1813088 second address: 181308E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 181308E second address: 181309D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jns 00007F43D0D9C308h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 181309D second address: 18130A2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 18176D3 second address: 18176F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push edx 0x0000000d pop edx 0x0000000e jmp 00007F43D0D9C310h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 18176F2 second address: 181770E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D1015A2Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F43D1015A2Ah 0x0000000e rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 181770E second address: 181773B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F43D0D9C30Dh 0x00000011 jmp 00007F43D0D9C314h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 181773B second address: 181774F instructions: 0x00000000 rdtsc 0x00000002 jl 00007F43D1015A2Eh 0x00000008 jne 00007F43D1015A26h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1817889 second address: 18178A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F43D0D9C311h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1817B95 second address: 1817BB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F43D1015A3Bh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1817BB6 second address: 1817BBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1817BBB second address: 1817BC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1817E63 second address: 1817E67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1817E67 second address: 1817E6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1817E6D second address: 1817E7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F43D0D9C30Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1817E7B second address: 1817E87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1817E87 second address: 1817E95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007F43D0D9C306h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1817E95 second address: 1817EA1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1817EA1 second address: 1817EA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1818137 second address: 1818147 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jp 00007F43D1015A26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1818592 second address: 18185A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F43D0D9C30Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 18185A3 second address: 18185C5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a jmp 00007F43D1015A38h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 18185C5 second address: 18185C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17C7BD3 second address: 17C7BED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F43D1015A2Dh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007F43D1015A26h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17C7BED second address: 17C7BF3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 181E1D5 second address: 181E1DF instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F43D1015A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 181E1DF second address: 181E215 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F43D0D9C314h 0x00000008 jno 00007F43D0D9C306h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 pop eax 0x00000015 pop edx 0x00000016 pop eax 0x00000017 jc 00007F43D0D9C32Fh 0x0000001d push eax 0x0000001e push edx 0x0000001f ja 00007F43D0D9C306h 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 181E215 second address: 181E219 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 181E7C5 second address: 181E7D7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a jg 00007F43D0D9C306h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 181EDE1 second address: 181EDE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 181EDE5 second address: 181EDEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 181EDEF second address: 181EDF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 181EF35 second address: 181EF52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F43D0D9C313h 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 18227C1 second address: 18227EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F43D1015A32h 0x0000000b popad 0x0000000c push edi 0x0000000d pushad 0x0000000e popad 0x0000000f pop edi 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jnc 00007F43D1015A2Eh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 182682B second address: 1826846 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D0D9C30Ah 0x00000007 pushad 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1826846 second address: 182684A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17DEE46 second address: 17DEE50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F43D0D9C306h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17DEE50 second address: 17DEE54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17DEE54 second address: 17DEEA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 call 00007F43D0D9C311h 0x0000000e mov ch, dh 0x00000010 pop ecx 0x00000011 lea eax, dword ptr [ebp+12BD6C00h] 0x00000017 mov edi, esi 0x00000019 mov edx, edi 0x0000001b nop 0x0000001c jmp 00007F43D0D9C30Ah 0x00000021 push eax 0x00000022 push eax 0x00000023 push edx 0x00000024 jnp 00007F43D0D9C31Bh 0x0000002a jmp 00007F43D0D9C315h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17DEEA4 second address: 17C70E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D1015A31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a sub dword ptr [ebp+12BAEB6Eh], edi 0x00000010 call dword ptr [ebp+12A21D5Bh] 0x00000016 pushad 0x00000017 jmp 00007F43D1015A39h 0x0000001c jng 00007F43D1015A39h 0x00000022 jmp 00007F43D1015A31h 0x00000027 pushad 0x00000028 popad 0x00000029 jng 00007F43D1015A28h 0x0000002f push edi 0x00000030 pop edi 0x00000031 popad 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17DF523 second address: 17DF564 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F43D0D9C306h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F43D0D9C30Bh 0x0000000f popad 0x00000010 push eax 0x00000011 jmp 00007F43D0D9C30Eh 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a jmp 00007F43D0D9C310h 0x0000001f mov eax, dword ptr [eax] 0x00000021 pushad 0x00000022 pushad 0x00000023 push ebx 0x00000024 pop ebx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17DF564 second address: 17DF57E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F43D1015A2Ch 0x0000000a popad 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f pushad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17DF57E second address: 17DF58D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F43D0D9C306h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17DF58D second address: 17DF591 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17DF6DB second address: 17DF6F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D0D9C312h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17DF6F8 second address: 17DF6FE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17DF6FE second address: 17DF70C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F43D0D9C30Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17DF70C second address: 17DF74E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D1015A32h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c or dword ptr [ebp+12A21C40h], esi 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jmp 00007F43D1015A33h 0x0000001b jmp 00007F43D1015A2Bh 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17DF74E second address: 17DF758 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F43D0D9C306h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17DF853 second address: 17DF894 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c pushad 0x0000000d jmp 00007F43D1015A35h 0x00000012 pushad 0x00000013 push edi 0x00000014 pop edi 0x00000015 jmp 00007F43D1015A34h 0x0000001a popad 0x0000001b popad 0x0000001c mov eax, dword ptr [eax] 0x0000001e pushad 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17DF997 second address: 17DF99C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17E019F second address: 17E01D6 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F43D1015A28h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b ja 00007F43D1015A2Ah 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 jmp 00007F43D1015A36h 0x0000001a mov eax, dword ptr [eax] 0x0000001c pushad 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17E02D8 second address: 17C7BD3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebx 0x0000000c call 00007F43D0D9C308h 0x00000011 pop ebx 0x00000012 mov dword ptr [esp+04h], ebx 0x00000016 add dword ptr [esp+04h], 0000001Ch 0x0000001e inc ebx 0x0000001f push ebx 0x00000020 ret 0x00000021 pop ebx 0x00000022 ret 0x00000023 call dword ptr [ebp+12A21B43h] 0x00000029 jl 00007F43D0D9C331h 0x0000002f pushad 0x00000030 push esi 0x00000031 pop esi 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1826E14 second address: 1826E5D instructions: 0x00000000 rdtsc 0x00000002 ja 00007F43D1015A38h 0x00000008 jmp 00007F43D1015A32h 0x0000000d push edi 0x0000000e push esi 0x0000000f pop esi 0x00000010 pop edi 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 push ebx 0x00000015 jmp 00007F43D1015A36h 0x0000001a jo 00007F43D1015A26h 0x00000020 pop ebx 0x00000021 push eax 0x00000022 push edx 0x00000023 jnl 00007F43D1015A26h 0x00000029 push ebx 0x0000002a pop ebx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1826E5D second address: 1826E6D instructions: 0x00000000 rdtsc 0x00000002 je 00007F43D0D9C306h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1826E6D second address: 1826E71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1827109 second address: 182710D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 182710D second address: 1827118 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1827118 second address: 1827123 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F43D0D9C306h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1827123 second address: 1827129 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 182E134 second address: 182E154 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D0D9C314h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jp 00007F43D0D9C306h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 182DC8F second address: 182DCA6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D1015A33h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 182DCA6 second address: 182DCCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F43D0D9C30Ch 0x0000000c pushad 0x0000000d popad 0x0000000e jbe 00007F43D0D9C306h 0x00000014 popad 0x00000015 popad 0x00000016 push ecx 0x00000017 push esi 0x00000018 jg 00007F43D0D9C306h 0x0000001e pop esi 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 18310B6 second address: 18310BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1830A10 second address: 1830A14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 18378C1 second address: 18378D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F43D1015A2Ch 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 18378D7 second address: 18378DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17DFCF3 second address: 17DFD2E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D1015A32h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c sub dword ptr [ebp+12A22018h], ecx 0x00000012 mov ebx, dword ptr [ebp+12BD6C3Fh] 0x00000018 mov dword ptr [ebp+12A21D40h], esi 0x0000001e add eax, ebx 0x00000020 mov cx, si 0x00000023 nop 0x00000024 js 00007F43D1015A44h 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17DFD2E second address: 17DFD32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17DFD32 second address: 17DFDAD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D1015A32h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F43D1015A2Fh 0x00000010 pushad 0x00000011 jmp 00007F43D1015A2Bh 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 popad 0x0000001a nop 0x0000001b push 00000000h 0x0000001d push ecx 0x0000001e call 00007F43D1015A28h 0x00000023 pop ecx 0x00000024 mov dword ptr [esp+04h], ecx 0x00000028 add dword ptr [esp+04h], 0000001Ch 0x00000030 inc ecx 0x00000031 push ecx 0x00000032 ret 0x00000033 pop ecx 0x00000034 ret 0x00000035 mov edx, ecx 0x00000037 push 00000004h 0x00000039 mov edi, dword ptr [ebp+12A22919h] 0x0000003f nop 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007F43D1015A32h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17DFDAD second address: 17DFDB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 17DFDB3 second address: 17DFDCA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jo 00007F43D1015A2Ch 0x00000011 jnp 00007F43D1015A26h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1836C44 second address: 1836C49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1836C49 second address: 1836C4E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1837592 second address: 18375E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F43D0D9C311h 0x00000009 je 00007F43D0D9C306h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 popad 0x00000012 jc 00007F43D0D9C308h 0x00000018 pushad 0x00000019 popad 0x0000001a jmp 00007F43D0D9C311h 0x0000001f jmp 00007F43D0D9C30Ch 0x00000024 popad 0x00000025 jo 00007F43D0D9C31Eh 0x0000002b jne 00007F43D0D9C318h 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 183B83D second address: 183B849 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F43D1015A26h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 183B849 second address: 183B864 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jne 00007F43D0D9C306h 0x00000009 pushad 0x0000000a popad 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F43D0D9C30Bh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 183AA47 second address: 183AA4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 183AEE9 second address: 183AEEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 183AEEF second address: 183AF16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D1015A2Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F43D1015A36h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 183B223 second address: 183B229 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 183B229 second address: 183B246 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D1015A2Fh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jp 00007F43D1015A2Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 183B246 second address: 183B254 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 jne 00007F43D0D9C306h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 183B254 second address: 183B258 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 183B258 second address: 183B271 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c jne 00007F43D0D9C306h 0x00000012 jc 00007F43D0D9C306h 0x00000018 pop ecx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 183B3FB second address: 183B3FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 183B3FF second address: 183B403 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 183F3B9 second address: 183F3C0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 183F3C0 second address: 183F3D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pushad 0x0000000b popad 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 183F3D1 second address: 183F3D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 183F3D5 second address: 183F3DB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 183F3DB second address: 183F3E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 183F3E1 second address: 183F3F3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jc 00007F43D0D9C306h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007F43D0D9C306h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 183F3F3 second address: 183F3F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 183EB5A second address: 183EB86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F43D0D9C310h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F43D0D9C312h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 183EB86 second address: 183EB8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 183ECE0 second address: 183ECE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 183EE07 second address: 183EE0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 183EE0D second address: 183EE34 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F43D0D9C306h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jo 00007F43D0D9C318h 0x00000012 jnc 00007F43D0D9C306h 0x00000018 jmp 00007F43D0D9C30Ch 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1846ADC second address: 1846AE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F43D1015A26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1846AE6 second address: 1846AEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1846DC9 second address: 1846DCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1846DCF second address: 1846DD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1846DD4 second address: 1846DE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F43D1015A2Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 184706E second address: 1847072 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1847072 second address: 184708E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D1015A36h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1847635 second address: 184763F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F43D0D9C306h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 184763F second address: 184765B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D1015A32h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 184765B second address: 1847674 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D0D9C315h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1847E17 second address: 1847E3D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F43D1015A36h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F43D1015A2Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 18480F3 second address: 184810B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F43D0D9C310h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 18483DE second address: 1848425 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edi 0x00000006 jmp 00007F43D1015A36h 0x0000000b pop edi 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007F43D1015A2Dh 0x00000015 jmp 00007F43D1015A37h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1848425 second address: 184843A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F43D0D9C30Ch 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 184843A second address: 1848444 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F43D1015A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 184D47F second address: 184D483 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 184D483 second address: 184D4A3 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F43D1015A26h 0x00000008 jmp 00007F43D1015A32h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 184D4A3 second address: 184D4B3 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F43D0D9C306h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 184D4B3 second address: 184D4B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 184D4B7 second address: 184D4BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 18512E7 second address: 18512ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1850766 second address: 185077D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F43D0D9C311h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 185077D second address: 1850787 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F43D1015A26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1850787 second address: 1850793 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1850793 second address: 185079F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1850A58 second address: 1850A5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1850FF4 second address: 185100F instructions: 0x00000000 rdtsc 0x00000002 ja 00007F43D1015A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push ebx 0x0000000c jl 00007F43D1015A2Ch 0x00000012 jne 00007F43D1015A26h 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 185757F second address: 18575A5 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F43D0D9C306h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F43D0D9C319h 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 18575A5 second address: 18575C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F43D1015A37h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 185781C second address: 185782C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D0D9C30Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 185782C second address: 1857836 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F43D1015A32h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1857836 second address: 185783C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 18579B7 second address: 18579BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1858927 second address: 185892D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 18569B7 second address: 18569D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jp 00007F43D1015A36h 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 18569D8 second address: 18569E2 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F43D0D9C306h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 18630BB second address: 18630D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 je 00007F43D1015A26h 0x0000000c jl 00007F43D1015A26h 0x00000012 popad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1862CBF second address: 1862CC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 186DD55 second address: 186DD5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 186DD5D second address: 186DD95 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F43D0D9C311h 0x0000000a pop ebx 0x0000000b pushad 0x0000000c jmp 00007F43D0D9C310h 0x00000011 jmp 00007F43D0D9C30Eh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 186DD95 second address: 186DD9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 18721AA second address: 18721AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 18721AE second address: 18721B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 18721B2 second address: 18721B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1873C65 second address: 1873C69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1873C69 second address: 1873C6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1873C6F second address: 1873C75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1878ECD second address: 1878ED1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1878ED1 second address: 1878ED7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 187D6E7 second address: 187D6F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 187D6F0 second address: 187D6F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 188771F second address: 1887723 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1888CAE second address: 1888CE4 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F43D1015A37h 0x00000008 jmp 00007F43D1015A31h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F43D1015A39h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1890E08 second address: 1890E60 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D0D9C312h 0x00000007 js 00007F43D0D9C306h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jno 00007F43D0D9C312h 0x00000015 je 00007F43D0D9C30Ch 0x0000001b ja 00007F43D0D9C306h 0x00000021 popad 0x00000022 push ebx 0x00000023 pushad 0x00000024 jmp 00007F43D0D9C319h 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1891424 second address: 1891429 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1891429 second address: 1891437 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F43D0D9C306h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1891437 second address: 189144F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F43D1015A30h 0x00000009 push edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1891599 second address: 18915B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F43D0D9C311h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 18915B1 second address: 18915B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 1891745 second address: 1891749 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 18959CB second address: 18959E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F43D1015A34h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 18E21EA second address: 18E21EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 19A6F3B second address: 19A6F3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 19A723C second address: 19A7248 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 je 00007F43D0D9C306h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 19A7A06 second address: 19A7A10 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F43D1015A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 19A7CE1 second address: 19A7D22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F43D0D9C306h 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F43D0D9C30Dh 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 jmp 00007F43D0D9C30Ah 0x00000019 pushad 0x0000001a push edi 0x0000001b pop edi 0x0000001c js 00007F43D0D9C306h 0x00000022 jmp 00007F43D0D9C30Dh 0x00000027 popad 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 19A7D22 second address: 19A7D28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 19AD681 second address: 19AD687 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 19AD687 second address: 19AD68C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 19AD745 second address: 19AD764 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007F43D0D9C318h 0x0000000d jmp 00007F43D0D9C312h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 19AD9A8 second address: 19AD9AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 19AD9AE second address: 19AD9C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F43D0D9C30Bh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 19AD9C6 second address: 19AD9DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D1015A30h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 19AF0EA second address: 19AF0EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 19AF0EE second address: 19AF0F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 19AF0F6 second address: 19AF106 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F43D0D9C30Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130026 second address: 7130054 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D1015A39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007F43D1015A2Ah 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130054 second address: 7130059 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130059 second address: 713009A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D1015A2Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F43D1015A30h 0x0000000f mov ebp, esp 0x00000011 jmp 00007F43D1015A30h 0x00000016 mov eax, dword ptr fs:[00000030h] 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 713009A second address: 713009E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 713009E second address: 71300A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71300A2 second address: 71300A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71300A8 second address: 71300CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D1015A34h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub esp, 18h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov esi, edx 0x00000011 push edx 0x00000012 pop esi 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71300CB second address: 71300FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D0D9C312h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F43D0D9C317h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71300FB second address: 713013B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D1015A39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F43D1015A2Ah 0x00000013 and cl, FFFFFFD8h 0x00000016 jmp 00007F43D1015A2Bh 0x0000001b popfd 0x0000001c mov ax, 938Fh 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 713013B second address: 7130141 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130141 second address: 7130145 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130145 second address: 71301A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D0D9C317h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c pushad 0x0000000d movzx ecx, dx 0x00000010 pushfd 0x00000011 jmp 00007F43D0D9C311h 0x00000016 sbb esi, 6D2EF9D6h 0x0000001c jmp 00007F43D0D9C311h 0x00000021 popfd 0x00000022 popad 0x00000023 mov ebx, dword ptr [eax+10h] 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F43D0D9C30Dh 0x0000002d rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71301A4 second address: 71301EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F43D1015A37h 0x00000009 sbb al, FFFFFFBEh 0x0000000c jmp 00007F43D1015A39h 0x00000011 popfd 0x00000012 mov eax, 60743D07h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, esi 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71301EB second address: 71301EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71301EF second address: 71301F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71301F3 second address: 71301F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71301F9 second address: 713021D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D1015A2Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F43D1015A2Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 713021D second address: 7130223 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130223 second address: 7130250 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F43D1015A39h 0x00000008 pop eax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, esi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F43D1015A2Ah 0x00000014 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130250 second address: 7130281 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov esi, dword ptr [756006ECh] 0x00000010 jmp 00007F43D0D9C319h 0x00000015 test esi, esi 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130281 second address: 7130285 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130285 second address: 713028B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 713028B second address: 713032A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D1015A32h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F43D10168B6h 0x0000000f jmp 00007F43D1015A30h 0x00000014 xchg eax, edi 0x00000015 jmp 00007F43D1015A30h 0x0000001a push eax 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007F43D1015A31h 0x00000022 sub cx, E636h 0x00000027 jmp 00007F43D1015A31h 0x0000002c popfd 0x0000002d push esi 0x0000002e call 00007F43D1015A37h 0x00000033 pop esi 0x00000034 pop edx 0x00000035 popad 0x00000036 xchg eax, edi 0x00000037 pushad 0x00000038 mov al, dl 0x0000003a popad 0x0000003b call dword ptr [755D0B60h] 0x00000041 mov eax, 7696E5E0h 0x00000046 ret 0x00000047 push eax 0x00000048 push edx 0x00000049 jmp 00007F43D1015A2Fh 0x0000004e rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 713032A second address: 7130330 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130330 second address: 7130334 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130417 second address: 713044A instructions: 0x00000000 rdtsc 0x00000002 mov edi, esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr fs:[00000030h] 0x0000000d jmp 00007F43D0D9C30Ah 0x00000012 push dword ptr [eax+18h] 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F43D0D9C317h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71304A5 second address: 71304E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F43D1015A35h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d je 00007F443F464C0Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F43D1015A38h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71304E4 second address: 71304F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D0D9C30Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71304F3 second address: 71304F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71304F9 second address: 71304FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71304FD second address: 713054D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D1015A2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub eax, eax 0x0000000d pushad 0x0000000e mov ax, dx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushfd 0x00000014 jmp 00007F43D1015A37h 0x00000019 add si, DF5Eh 0x0000001e jmp 00007F43D1015A39h 0x00000023 popfd 0x00000024 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 713054D second address: 713057B instructions: 0x00000000 rdtsc 0x00000002 mov ah, ACh 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esi], edi 0x00000009 pushad 0x0000000a mov di, B46Ch 0x0000000e mov ch, bh 0x00000010 popad 0x00000011 mov dword ptr [esi+04h], eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F43D0D9C316h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 713057B second address: 7130581 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130581 second address: 7130587 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130587 second address: 713058B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 713058B second address: 713058F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 713058F second address: 71305AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+08h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F43D1015A2Eh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71305AC second address: 71305BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D0D9C30Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130838 second address: 713083D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 713083D second address: 7130873 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F43D0D9C315h 0x0000000a jmp 00007F43D0D9C30Bh 0x0000000f popfd 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 mov ax, word ptr [ebx+00000088h] 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130873 second address: 713088E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D1015A37h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 713088E second address: 7130894 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130894 second address: 7130898 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130898 second address: 713089C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 713089C second address: 7130912 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov word ptr [esi+32h], ax 0x0000000c jmp 00007F43D1015A37h 0x00000011 mov eax, dword ptr [ebx+0000008Ch] 0x00000017 pushad 0x00000018 mov ecx, 162FBD5Bh 0x0000001d push eax 0x0000001e call 00007F43D1015A37h 0x00000023 pop ecx 0x00000024 pop edx 0x00000025 popad 0x00000026 mov dword ptr [esi+34h], eax 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c mov ecx, edi 0x0000002e pushfd 0x0000002f jmp 00007F43D1015A2Dh 0x00000034 sbb al, 00000046h 0x00000037 jmp 00007F43D1015A31h 0x0000003c popfd 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130912 second address: 713099D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F43D0D9C317h 0x00000008 movzx ecx, bx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [ebx+18h] 0x00000011 jmp 00007F43D0D9C30Bh 0x00000016 mov dword ptr [esi+38h], eax 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007F43D0D9C314h 0x00000020 and al, 00000078h 0x00000023 jmp 00007F43D0D9C30Bh 0x00000028 popfd 0x00000029 pushfd 0x0000002a jmp 00007F43D0D9C318h 0x0000002f sbb esi, 571DADD8h 0x00000035 jmp 00007F43D0D9C30Bh 0x0000003a popfd 0x0000003b popad 0x0000003c mov eax, dword ptr [ebx+1Ch] 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 713099D second address: 71309B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D1015A37h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71309B8 second address: 71309D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F43D0D9C314h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71309D0 second address: 71309E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+3Ch], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F43D1015A2Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71309E7 second address: 7130A7D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ah, bl 0x00000005 mov eax, 67B1EC99h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [ebx+20h] 0x00000010 jmp 00007F43D0D9C314h 0x00000015 mov dword ptr [esi+40h], eax 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F43D0D9C30Eh 0x0000001f xor eax, 5956F758h 0x00000025 jmp 00007F43D0D9C30Bh 0x0000002a popfd 0x0000002b pushfd 0x0000002c jmp 00007F43D0D9C318h 0x00000031 add cl, FFFFFFB8h 0x00000034 jmp 00007F43D0D9C30Bh 0x00000039 popfd 0x0000003a popad 0x0000003b lea eax, dword ptr [ebx+00000080h] 0x00000041 jmp 00007F43D0D9C316h 0x00000046 push 00000001h 0x00000048 push eax 0x00000049 push edx 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130A7D second address: 7130A9A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D1015A39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130A9A second address: 7130AA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130AA0 second address: 7130AA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130AA4 second address: 7130AA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130AA8 second address: 7130ABB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a mov cx, 00C1h 0x0000000e push eax 0x0000000f push edx 0x00000010 mov di, si 0x00000013 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130B56 second address: 7130B73 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D0D9C319h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130B73 second address: 7130BBF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D1015A31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, eax 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F43D1015A2Ch 0x00000012 add ecx, 1F1E4F18h 0x00000018 jmp 00007F43D1015A2Bh 0x0000001d popfd 0x0000001e mov bh, cl 0x00000020 popad 0x00000021 test edi, edi 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F43D1015A2Eh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130BBF second address: 7130C06 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D0D9C30Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007F443F1EADFBh 0x0000000f jmp 00007F43D0D9C316h 0x00000014 mov eax, dword ptr [ebp-0Ch] 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F43D0D9C317h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130C06 second address: 7130C3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D1015A39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+04h], eax 0x0000000c jmp 00007F43D1015A2Eh 0x00000011 lea eax, dword ptr [ebx+78h] 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130C3D second address: 7130C43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130C43 second address: 7130C4A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130C4A second address: 7130C81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push 00000001h 0x00000009 pushad 0x0000000a mov di, ax 0x0000000d mov dx, si 0x00000010 popad 0x00000011 nop 0x00000012 pushad 0x00000013 mov edi, ecx 0x00000015 push esi 0x00000016 pushad 0x00000017 popad 0x00000018 pop ebx 0x00000019 popad 0x0000001a push eax 0x0000001b pushad 0x0000001c mov bh, 70h 0x0000001e mov eax, 6D091979h 0x00000023 popad 0x00000024 nop 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F43D0D9C30Eh 0x0000002e rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130C81 second address: 7130C85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130C85 second address: 7130C8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130C8B second address: 7130CE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F43D1015A2Ch 0x00000008 pop eax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c lea eax, dword ptr [ebp-08h] 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F43D1015A39h 0x00000018 sbb ax, 4256h 0x0000001d jmp 00007F43D1015A31h 0x00000022 popfd 0x00000023 jmp 00007F43D1015A30h 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130CE6 second address: 7130CEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130CEC second address: 7130CF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130CF0 second address: 7130CF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130CF4 second address: 7130D1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jmp 00007F43D1015A36h 0x0000000e mov dword ptr [esp], eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130D1C second address: 7130D20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130D20 second address: 7130D24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130D24 second address: 7130D2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130D2A second address: 7130D30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130D72 second address: 7130DB6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D0D9C30Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebp-04h] 0x0000000c jmp 00007F43D0D9C316h 0x00000011 mov dword ptr [esi+08h], eax 0x00000014 jmp 00007F43D0D9C310h 0x00000019 lea eax, dword ptr [ebx+70h] 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130DB6 second address: 7130DBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130DBA second address: 7130DC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130DC0 second address: 7130DC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130DC6 second address: 7130DCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130DCA second address: 7130DE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push 00000001h 0x0000000a jmp 00007F43D1015A2Ah 0x0000000f nop 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130DE4 second address: 7130DEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130DEB second address: 7130E8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F43D1015A34h 0x00000008 mov ah, 5Bh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007F43D1015A2Ch 0x00000013 nop 0x00000014 jmp 00007F43D1015A30h 0x00000019 lea eax, dword ptr [ebp-18h] 0x0000001c jmp 00007F43D1015A30h 0x00000021 nop 0x00000022 pushad 0x00000023 pushfd 0x00000024 jmp 00007F43D1015A2Eh 0x00000029 sub cl, FFFFFFD8h 0x0000002c jmp 00007F43D1015A2Bh 0x00000031 popfd 0x00000032 mov edx, esi 0x00000034 popad 0x00000035 push eax 0x00000036 jmp 00007F43D1015A35h 0x0000003b nop 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f jmp 00007F43D1015A33h 0x00000044 movzx ecx, di 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130EA4 second address: 7130EA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130EA8 second address: 7130EAE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130EAE second address: 7130F0A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F43D0D9C318h 0x00000008 pop ecx 0x00000009 pushfd 0x0000000a jmp 00007F43D0D9C30Bh 0x0000000f and eax, 453ABCBEh 0x00000015 jmp 00007F43D0D9C319h 0x0000001a popfd 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e mov edi, eax 0x00000020 pushad 0x00000021 call 00007F43D0D9C30Ch 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130F0A second address: 7130F5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F43D1015A31h 0x0000000a popad 0x0000000b test edi, edi 0x0000000d pushad 0x0000000e mov edx, ecx 0x00000010 mov dl, ch 0x00000012 popad 0x00000013 js 00007F443F4641ACh 0x00000019 jmp 00007F43D1015A2Bh 0x0000001e mov eax, dword ptr [ebp-14h] 0x00000021 jmp 00007F43D1015A36h 0x00000026 mov ecx, esi 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b mov dx, 1890h 0x0000002f mov esi, edi 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130F5F second address: 7130F83 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, esi 0x00000005 push eax 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esi+0Ch], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F43D0D9C315h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130F83 second address: 7130F89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130F89 second address: 7130FAD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D0D9C313h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov edx, 756006ECh 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130FAD second address: 7130FB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130FB1 second address: 7130FB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130FB7 second address: 7130FCD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D1015A2Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub eax, eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130FCD second address: 7130FD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130FD1 second address: 7130FEB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D1015A36h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7130FEB second address: 7131026 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F43D0D9C311h 0x00000009 and cx, 41E6h 0x0000000e jmp 00007F43D0D9C311h 0x00000013 popfd 0x00000014 mov edi, eax 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 lock cmpxchg dword ptr [edx], ecx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7131026 second address: 713102A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 713102A second address: 7131039 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D0D9C30Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7131039 second address: 71310DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F43D1015A2Fh 0x00000009 add ecx, 35B7C9CEh 0x0000000f jmp 00007F43D1015A39h 0x00000014 popfd 0x00000015 call 00007F43D1015A30h 0x0000001a pop esi 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e pop edi 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007F43D1015A37h 0x00000026 xor cx, F48Eh 0x0000002b jmp 00007F43D1015A39h 0x00000030 popfd 0x00000031 push eax 0x00000032 call 00007F43D1015A37h 0x00000037 pop esi 0x00000038 pop ebx 0x00000039 popad 0x0000003a test eax, eax 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71310DC second address: 71310E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71310E0 second address: 71310E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71310E6 second address: 71310F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F43D0D9C30Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71310F9 second address: 7131141 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F443F464001h 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F43D1015A2Bh 0x00000015 adc ch, FFFFFFAEh 0x00000018 jmp 00007F43D1015A39h 0x0000001d popfd 0x0000001e mov eax, 7C3EDD37h 0x00000023 popad 0x00000024 mov edx, dword ptr [ebp+08h] 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a mov cx, 0BC5h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7131141 second address: 71311AC instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F43D0D9C312h 0x00000008 sbb al, 00000058h 0x0000000b jmp 00007F43D0D9C30Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushfd 0x00000014 jmp 00007F43D0D9C318h 0x00000019 adc eax, 6A4B73B8h 0x0000001f jmp 00007F43D0D9C30Bh 0x00000024 popfd 0x00000025 popad 0x00000026 mov eax, dword ptr [esi] 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F43D0D9C315h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71311AC second address: 71311B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71311B2 second address: 71311B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71311B6 second address: 71311BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71311BA second address: 71311ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [edx], eax 0x0000000a jmp 00007F43D0D9C30Fh 0x0000000f mov eax, dword ptr [esi+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F43D0D9C315h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71311ED second address: 7131268 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edx 0x00000005 pushfd 0x00000006 jmp 00007F43D1015A33h 0x0000000b or esi, 652D7CEEh 0x00000011 jmp 00007F43D1015A39h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov dword ptr [edx+04h], eax 0x0000001d jmp 00007F43D1015A2Eh 0x00000022 mov eax, dword ptr [esi+08h] 0x00000025 jmp 00007F43D1015A30h 0x0000002a mov dword ptr [edx+08h], eax 0x0000002d jmp 00007F43D1015A30h 0x00000032 mov eax, dword ptr [esi+0Ch] 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7131268 second address: 713126F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 713126F second address: 7131299 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, si 0x00000006 mov di, cx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [edx+0Ch], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F43D10117D9h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7131299 second address: 713129F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 713129F second address: 71312D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D10117D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esi+10h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F43D10117D5h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71312D2 second address: 71312D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71312D8 second address: 71312DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71312DC second address: 71312E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71312E0 second address: 713135B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [edx+10h], eax 0x0000000b jmp 00007F43D10117CFh 0x00000010 mov eax, dword ptr [esi+14h] 0x00000013 jmp 00007F43D10117D6h 0x00000018 mov dword ptr [edx+14h], eax 0x0000001b jmp 00007F43D10117D0h 0x00000020 mov eax, dword ptr [esi+18h] 0x00000023 jmp 00007F43D10117D0h 0x00000028 mov dword ptr [edx+18h], eax 0x0000002b pushad 0x0000002c call 00007F43D10117CEh 0x00000031 pushad 0x00000032 popad 0x00000033 pop ecx 0x00000034 movsx edx, ax 0x00000037 popad 0x00000038 mov eax, dword ptr [esi+1Ch] 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 713135B second address: 713135F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 713135F second address: 7131365 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7131365 second address: 713139F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D0BEE79Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+1Ch], eax 0x0000000c jmp 00007F43D0BEE7A0h 0x00000011 mov eax, dword ptr [esi+20h] 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 call 00007F43D0BEE79Dh 0x0000001c pop ecx 0x0000001d mov ecx, edi 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 713139F second address: 71313E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, ax 0x00000006 pushfd 0x00000007 jmp 00007F43D10117D4h 0x0000000c xor ax, CC28h 0x00000011 jmp 00007F43D10117CBh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov dword ptr [edx+20h], eax 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F43D10117D5h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71313E8 second address: 713146B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D0BEE7A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esi+24h] 0x0000000c pushad 0x0000000d mov cx, 0B93h 0x00000011 movzx ecx, di 0x00000014 popad 0x00000015 mov dword ptr [edx+24h], eax 0x00000018 pushad 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007F43D0BEE7A6h 0x00000020 sub al, 00000048h 0x00000023 jmp 00007F43D0BEE79Bh 0x00000028 popfd 0x00000029 popad 0x0000002a popad 0x0000002b mov eax, dword ptr [esi+28h] 0x0000002e jmp 00007F43D0BEE7A6h 0x00000033 mov dword ptr [edx+28h], eax 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F43D0BEE7A7h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 713146B second address: 7131483 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F43D10117D4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7131483 second address: 7131487 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7131487 second address: 71314EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, dword ptr [esi+2Ch] 0x0000000b pushad 0x0000000c jmp 00007F43D10117D8h 0x00000011 popad 0x00000012 mov dword ptr [edx+2Ch], ecx 0x00000015 jmp 00007F43D10117D0h 0x0000001a mov ax, word ptr [esi+30h] 0x0000001e jmp 00007F43D10117D0h 0x00000023 mov word ptr [edx+30h], ax 0x00000027 pushad 0x00000028 mov ax, 7D0Dh 0x0000002c movzx eax, bx 0x0000002f popad 0x00000030 mov ax, word ptr [esi+32h] 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 mov eax, 3A60C37Dh 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71314EE second address: 71314F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71314F3 second address: 7131573 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, cx 0x00000006 pushfd 0x00000007 jmp 00007F43D10117D0h 0x0000000c adc eax, 4E23D188h 0x00000012 jmp 00007F43D10117CBh 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov word ptr [edx+32h], ax 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007F43D10117CBh 0x00000028 add esi, 098475CEh 0x0000002e jmp 00007F43D10117D9h 0x00000033 popfd 0x00000034 pushfd 0x00000035 jmp 00007F43D10117D0h 0x0000003a or ch, 00000048h 0x0000003d jmp 00007F43D10117CBh 0x00000042 popfd 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7131573 second address: 713158B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F43D0BEE7A4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 713158B second address: 713158F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 713158F second address: 71315DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esi+34h] 0x0000000b pushad 0x0000000c mov di, C4C0h 0x00000010 push ebx 0x00000011 pushfd 0x00000012 jmp 00007F43D0BEE7A4h 0x00000017 add esi, 08537B08h 0x0000001d jmp 00007F43D0BEE79Bh 0x00000022 popfd 0x00000023 pop esi 0x00000024 popad 0x00000025 mov dword ptr [edx+34h], eax 0x00000028 pushad 0x00000029 mov ax, di 0x0000002c popad 0x0000002d test ecx, 00000700h 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71315DD second address: 71315E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71315E1 second address: 71315E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71315E7 second address: 7131639 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D10117CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F443F45F8E4h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 pushfd 0x00000015 jmp 00007F43D10117D3h 0x0000001a and eax, 6478B95Eh 0x00000020 jmp 00007F43D10117D9h 0x00000025 popfd 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7131639 second address: 71316B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D0BEE7A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 or dword ptr [edx+38h], FFFFFFFFh 0x0000000d jmp 00007F43D0BEE79Eh 0x00000012 or dword ptr [edx+3Ch], FFFFFFFFh 0x00000016 jmp 00007F43D0BEE7A0h 0x0000001b or dword ptr [edx+40h], FFFFFFFFh 0x0000001f jmp 00007F43D0BEE7A0h 0x00000024 pop esi 0x00000025 jmp 00007F43D0BEE7A0h 0x0000002a pop ebx 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e pushfd 0x0000002f jmp 00007F43D0BEE79Ch 0x00000034 or al, 00000048h 0x00000037 jmp 00007F43D0BEE79Bh 0x0000003c popfd 0x0000003d rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71316B9 second address: 71316FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F43D10117CFh 0x0000000a add si, CB8Eh 0x0000000f jmp 00007F43D10117D9h 0x00000014 popfd 0x00000015 popad 0x00000016 leave 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F43D10117CDh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7180C5E second address: 7180C6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F43D0BEE79Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7180C6E second address: 7180C88 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D10117CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov edi, eax 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7180C88 second address: 7180C8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7180C8E second address: 7180C9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov bl, cl 0x0000000e push edx 0x0000000f pop eax 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7180C9F second address: 7180CB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F43D0BEE7A1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7180CB4 second address: 7180D09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b call 00007F43D10117D3h 0x00000010 call 00007F43D10117D8h 0x00000015 pop ecx 0x00000016 pop edx 0x00000017 movzx eax, bx 0x0000001a popad 0x0000001b pop ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F43D10117D6h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7180D09 second address: 7180D1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F43D0BEE79Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 70C0052 second address: 70C0096 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D10117D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F43D10117D1h 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 push ecx 0x00000012 push ebx 0x00000013 pop ecx 0x00000014 pop ebx 0x00000015 mov eax, 5CD2928Bh 0x0000001a popad 0x0000001b mov ebp, esp 0x0000001d pushad 0x0000001e call 00007F43D10117CCh 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 70C0096 second address: 70C00E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 pushfd 0x00000007 jmp 00007F43D0BEE79Ch 0x0000000c and ax, 41C8h 0x00000011 jmp 00007F43D0BEE79Bh 0x00000016 popfd 0x00000017 pop eax 0x00000018 popad 0x00000019 pop ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d mov cx, 9337h 0x00000021 pushfd 0x00000022 jmp 00007F43D0BEE79Ch 0x00000027 sub ax, 4428h 0x0000002c jmp 00007F43D0BEE79Bh 0x00000031 popfd 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 70C077E second address: 70C07F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D10117D0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov cl, 1Ah 0x0000000d pushfd 0x0000000e jmp 00007F43D10117D3h 0x00000013 adc al, FFFFFFEEh 0x00000016 jmp 00007F43D10117D9h 0x0000001b popfd 0x0000001c popad 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 mov ebx, ecx 0x00000023 pushfd 0x00000024 jmp 00007F43D10117D6h 0x00000029 sbb ax, 7498h 0x0000002e jmp 00007F43D10117CBh 0x00000033 popfd 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 70C0B1D second address: 70C0B27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 70C0B27 second address: 70C0B2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 70C0B2B second address: 70C0B6B instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F43D0BEE7A2h 0x00000008 add cx, 3808h 0x0000000d jmp 00007F43D0BEE79Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F43D0BEE7A4h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 70C0B6B second address: 70C0B71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 70C0B71 second address: 70C0B75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 70C0B75 second address: 70C0BCE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F43D10117D9h 0x0000000e mov ebp, esp 0x00000010 pushad 0x00000011 pushad 0x00000012 mov si, AB99h 0x00000016 push esi 0x00000017 pop ebx 0x00000018 popad 0x00000019 pushfd 0x0000001a jmp 00007F43D10117D2h 0x0000001f or ax, AF28h 0x00000024 jmp 00007F43D10117CBh 0x00000029 popfd 0x0000002a popad 0x0000002b pop ebp 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 70C0BCE second address: 70C0BD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 70C0BD2 second address: 70C0BD8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 70C0BD8 second address: 70C0BF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F43D0BEE7A9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 70C0BF5 second address: 70C0BF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71108A6 second address: 71108DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F43D0BEE7A4h 0x00000009 sub ax, CEA8h 0x0000000e jmp 00007F43D0BEE79Bh 0x00000013 popfd 0x00000014 mov edi, ecx 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71108DB second address: 71108DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71108DF second address: 71108E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 71108E5 second address: 711090E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F43D10117D4h 0x00000009 sub ch, 00000038h 0x0000000c jmp 00007F43D10117CBh 0x00000011 popfd 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 711090E second address: 711092F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F43D0BEE79Fh 0x0000000d xchg eax, ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 movsx edi, si 0x00000014 push eax 0x00000015 pop edi 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 711092F second address: 7110935 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 7110935 second address: 7110939 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 70F0023 second address: 70F003F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D10117D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 70F003F second address: 70F0059 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D0BEE7A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 70F0059 second address: 70F0060 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, dh 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 70F0060 second address: 70F00EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 jmp 00007F43D0BEE7A6h 0x0000000d mov ebp, esp 0x0000000f jmp 00007F43D0BEE7A0h 0x00000014 and esp, FFFFFFF0h 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F43D0BEE79Eh 0x0000001e xor esi, 7CB19918h 0x00000024 jmp 00007F43D0BEE79Bh 0x00000029 popfd 0x0000002a pushfd 0x0000002b jmp 00007F43D0BEE7A8h 0x00000030 adc ecx, 23EF8378h 0x00000036 jmp 00007F43D0BEE79Bh 0x0000003b popfd 0x0000003c popad 0x0000003d sub esp, 44h 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 70F00EA second address: 70F0105 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43D10117D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 70F0105 second address: 70F010B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 70F010B second address: 70F010F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 70F010F second address: 70F0113 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 70F0113 second address: 70F0131 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F43D10117D3h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 70F0131 second address: 70F0149 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F43D0BEE7A4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 70F0149 second address: 70F0172 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebx 0x0000000b jmp 00007F43D10117D7h 0x00000010 xchg eax, esi 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 70F0172 second address: 70F0176 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	RDTSC instruction interceptor: First address: 70F0176 second address: 70F017C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Special instruction interceptor: First address: 162BC31 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Special instruction interceptor: First address: 1864616 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\uwa78qqv0x.exe

Code function: 0_2_07100A41 rdtsc

0_2_07100A41

Source: C:\Users\user\Desktop\uwa78qqv0x.exe

API coverage: 3.6 %

Source: C:\Users\user\Desktop\uwa78qqv0x.exe TID: 7620

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\uwa78qqv0x.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\uwa78qqv0x.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: uwa78qqv0x.exe, uwa78qqv0x.exe, 00000000.00000002.1633291586.00000000017B5000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware-42 27 c5 9a 47 85 d6 84-53 49 ec ec 87 a6 6d 67
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: uwa78qqv0x.exe, 00000000.00000002.1632765897.00000000014BD000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: SYSINTERNALSNum_processorNum_ramnameallfreedriversNum_displaysresolution_xresolution_y\recent_filesprocessesuptime_minutesC:\Windows\System32\VBox.dll01vbox_firstSYSTEM\ControlSet001\Services\VBoxSFvbox_secondC:\USERS\PUBLIC\public_checkWINDBG.EXEdbgwireshark.exeprocmon.exex64dbg.exeida.exedbg_secdbg_thirdyadroinstalled_appsSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall%d%s\%sDisplayNameapp_nameindexCreateToolhelp32Snapshot failed.
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: uwa78qqv0x.exe, 00000000.00000002.1632599745.0000000000A0A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: uwa78qqv0x.exe, 00000000.00000002.1632765897.00000000014BD000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: SYSTEM\ControlSet001\Services\VBoxSF
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: uwa78qqv0x.exe, 00000000.00000002.1633291586.00000000017B5000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\uwa78qqv0x.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\uwa78qqv0x.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\uwa78qqv0x.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\uwa78qqv0x.exe	File opened: NTICE
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	File opened: SICE
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\uwa78qqv0x.exe

Code function: 0_2_07100A41 rdtsc

0_2_07100A41

Source: uwa78qqv0x.exe, uwa78qqv0x.exe, 00000000.00000002.1633291586.00000000017B5000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uwa78qqv0x.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\uwa78qqv0x.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: uwa78qqv0x.exe, 00000000.00000003.1435204736.0000000007416000.00000004.00001000.00020000.00000000.sdmp, uwa78qqv0x.exe, 00000000.00000002.1632765897.00000000014BD000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: procmon.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: uwa78qqv0x.exe, 00000000.00000003.1435204736.0000000007416000.00000004.00001000.00020000.00000000.sdmp, uwa78qqv0x.exe, 00000000.00000002.1632765897.00000000014BD000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: wireshark.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	2 Process Injection	24 Virtualization/Sandbox Evasion	OS Credential Dumping	751 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	2 Process Injection	LSASS Memory	24 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 Remote System Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	214 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
uwa78qqv0x.exe	66%	ReversingLabs	Win32.Trojan.Amadey
uwa78qqv0x.exe	47%	Virustotal		Browse
uwa78qqv0x.exe	100%	Avira	TR/Crypt.TPM.Gen
uwa78qqv0x.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
httpbin.org	98.85.100.80	true	false		high
home.fivetk5ht.top	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://httpbin.org/ip	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://curl.se/docs/hsts.html	uwa78qqv0x.exe, 00000000.00000002.1632765897.00000000014BD000.00000040.00000001.01000000.00000003.sdmp	false	high
http://html4/loose.dtd	uwa78qqv0x.exe, 00000000.00000003.1435204736.0000000007416000.00000004.00001000.00020000.00000000.sdmp, uwa78qqv0x.exe, 00000000.00000002.1632765897.00000000014BD000.00000040.00000001.01000000.00000003.sdmp	false	high
http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851http://home.fivetk5ht.top/zldPRFrmVFHTtKntGp	uwa78qqv0x.exe, 00000000.00000002.1632765897.00000000014BD000.00000040.00000001.01000000.00000003.sdmp	false	high
https://httpbin.org/ipbefore	uwa78qqv0x.exe, 00000000.00000003.1435204736.0000000007416000.00000004.00001000.00020000.00000000.sdmp, uwa78qqv0x.exe, 00000000.00000002.1632765897.00000000014BD000.00000040.00000001.01000000.00000003.sdmp	false	high
https://curl.se/docs/http-cookies.html	uwa78qqv0x.exe, 00000000.00000003.1435204736.0000000007416000.00000004.00001000.00020000.00000000.sdmp, uwa78qqv0x.exe, 00000000.00000002.1632765897.00000000014BD000.00000040.00000001.01000000.00000003.sdmp	false	high
http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851	uwa78qqv0x.exe, 00000000.00000002.1632765897.00000000014BD000.00000040.00000001.01000000.00000003.sdmp, uwa78qqv0x.exe, 00000000.00000002.1632599745.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, uwa78qqv0x.exe, 00000000.00000002.1632599745.0000000000A0A000.00000004.00000020.00020000.00000000.sdmp	false	high
http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv17345798516963	uwa78qqv0x.exe, 00000000.00000002.1632599745.00000000009AE000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv17	uwa78qqv0x.exe, 00000000.00000002.1632765897.00000000014BD000.00000040.00000001.01000000.00000003.sdmp	false	high
http://upx.sf.net	Amcache.hve.4.dr	false	high
https://curl.se/docs/alt-svc.html	uwa78qqv0x.exe, 00000000.00000002.1632765897.00000000014BD000.00000040.00000001.01000000.00000003.sdmp	false	high
http://.css	uwa78qqv0x.exe, 00000000.00000003.1435204736.0000000007416000.00000004.00001000.00020000.00000000.sdmp, uwa78qqv0x.exe, 00000000.00000002.1632765897.00000000014BD000.00000040.00000001.01000000.00000003.sdmp	false	high
http://.jpg	uwa78qqv0x.exe, 00000000.00000003.1435204736.0000000007416000.00000004.00001000.00020000.00000000.sdmp, uwa78qqv0x.exe, 00000000.00000002.1632765897.00000000014BD000.00000040.00000001.01000000.00000003.sdmp	false	high
http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851l	uwa78qqv0x.exe, 00000000.00000002.1632599745.0000000000A0A000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
98.85.100.80	httpbin.org	United States		11351	TWC-11351-NORTHEASTUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579670
Start date and time:	2024-12-23 07:20:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	uwa78qqv0x.exe renamed because original name is a hash value
Original Sample Name:	1f26197a5239abd7c93b7dc95c79f102.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@2/5@14/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.65.92, 20.190.181.1, 20.109.210.53, 4.245.163.56
Excluded domains from analysis (whitelisted): onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

Time	Type	Description
01:21:07	API Interceptor	6x Sleep call for process: uwa78qqv0x.exe modified
01:21:20	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
98.85.100.80	fW6RLQpTIt.exe	Get hash	malicious	Cryptbot	Browse
	p3a0oZ4U7X.exe	Get hash	malicious	Unknown	Browse
	3mwHWIPiSo.exe	Get hash	malicious	Cryptbot	Browse
	QeM0UAj5PK.exe	Get hash	malicious	Unknown	Browse
	GO33c8HVWG.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse
	5JfTgoNUcB.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse
	7XioudDqb8.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse
	gVMKOpATpQ.exe	Get hash	malicious	Unknown	Browse
	5wgTw8pA13.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse
	bwyUxrKbYN.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
httpbin.org	OmLwjD18cO.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.226.108.155
	N3s5DQ51YF.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.226.108.155
	fW6RLQpTIt.exe	Get hash	malicious	Cryptbot	Browse	98.85.100.80
	p3a0oZ4U7X.exe	Get hash	malicious	Unknown	Browse	98.85.100.80
	3mwHWIPiSo.exe	Get hash	malicious	Cryptbot	Browse	98.85.100.80
	QeM0UAj5PK.exe	Get hash	malicious	Unknown	Browse	98.85.100.80
	GO33c8HVWG.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	98.85.100.80
	5JfTgoNUcB.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	98.85.100.80
	7XioudDqb8.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	98.85.100.80
	gVMKOpATpQ.exe	Get hash	malicious	Unknown	Browse	98.85.100.80

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TWC-11351-NORTHEASTUS	fW6RLQpTIt.exe	Get hash	malicious	Cryptbot	Browse	98.85.100.80
	p3a0oZ4U7X.exe	Get hash	malicious	Unknown	Browse	98.85.100.80
	3mwHWIPiSo.exe	Get hash	malicious	Cryptbot	Browse	98.85.100.80
	QeM0UAj5PK.exe	Get hash	malicious	Unknown	Browse	98.85.100.80
	GO33c8HVWG.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	98.85.100.80
	5JfTgoNUcB.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	98.85.100.80
	7XioudDqb8.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	98.85.100.80
	gVMKOpATpQ.exe	Get hash	malicious	Unknown	Browse	98.85.100.80
	5wgTw8pA13.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	98.85.100.80
	bwyUxrKbYN.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	98.85.100.80

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_uwa78qqv0x.exe_48a44e25356dcac01dc63e486932e2a2d4eecb3c_7c1cd271_5544698b-a6f2-4784-a8f8-d05a9453646b\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9433875017504563
Encrypted:	false
SSDEEP:	192:qzpoGLob0BU/Aju0ZrPMtwzuiFqZ24IO8O:02cooBU/Aj5zuiFqY4IO8O
MD5:	93F3F23EB43E7BF4B9EE3179A204110A
SHA1:	CAF0B2BBA1C96ECE6E417DB854B0FCD82691BD76
SHA-256:	347C76E4F27164EDEA4E5294F53CB346F55FBFAA677F0447316B8BEAB1DD2FAE
SHA-512:	7F3FF0E19678770AAEBAFE4DDFF079A96CBBE1F411EDE887829CCBAC591F7B77BFD1A723379DCD22B7061102C5E3A4D18A1D1D4AADFD4C3B46EDE399A11E8AF0
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.9.4.0.8.4.6.9.9.9.7.9.3.7.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.9.4.0.8.4.7.0.4.8.2.3.2.4.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.5.4.4.6.9.8.b.-.a.6.f.2.-.4.7.8.4.-.a.8.f.8.-.d.0.5.a.9.4.5.3.6.4.6.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.0.4.3.8.9.5.1.-.b.2.f.f.-.4.e.8.c.-.a.b.3.f.-.d.a.6.8.7.6.0.9.6.2.9.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.u.w.a.7.8.q.q.v.0.x...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.c.0.-.0.0.0.1.-.0.0.1.4.-.c.8.d.f.-.5.5.d.6.0.2.5.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.3.9.f.d.4.b.5.6.0.4.f.f.1.2.1.f.6.e.6.9.7.7.e.4.6.6.c.f.e.a.a.0.0.0.0.f.f.f.f.!.0.0.0.0.6.8.8.4.9.6.1.0.3.9.4.a.5.7.3.c.7.e.d.1.5.b.a.0.c.d.9.2.0.0.f.1.0.d.e.9.b.4.3.5.!.u.w.a.7.8.q.q.v.0.x...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2A54.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon Dec 23 06:21:10 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	208226
Entropy (8bit):	1.4348027896291438
Encrypted:	false
SSDEEP:	768:nli04soEqAeVA858MzZQOrAAeesRWaRUq:w04sAh8MFQOrXefWHq
MD5:	D2B3BD58873BF7F965964790C607B798
SHA1:	198E67AC5122C12A4FC8D80FEE925D7F7907D06D
SHA-256:	E331001778036F5D4435F0BBCB38D23B6750DD7D4D58E4A01916F40B36D733A1
SHA-512:	C2B60FDE5AE6B0E97CE1C2988778DBFD560C87E3E7489D1ED8FCB746D8BBFE0E9F7F0506A797929C67936C2F9F8327C50EBFE394310E2DCADCBAE60899A41DCB
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......V.ig............D...........D...X............ ......4....z..........`.......8...........T...........H,.............. !...........#..............................................................................eJ.......#......GenuineIntel............T...........M.ig.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2B3F.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8348
Entropy (8bit):	3.6987453502018304
Encrypted:	false
SSDEEP:	192:R6l7wVeJFE6PZ6s6YSHSU96ugmfVbiprv89bAYsfOgm:R6lXJm6Pn6YSSU9jgmfVbvALfQ
MD5:	1EA2634D9E15D356D60FD62923D44AA3
SHA1:	37DC6FA50CC9E37B9E55190744FB314BEF5F7B70
SHA-256:	2A6DF42330DCDE1E645ADAEB005961EFE213A2AF3D85880311DEF91771CF5D43
SHA-512:	F293D5DCCB3ECBB44AB5E30FC43F95273F0F0D71D73FB7FBA417DFB793A9A386A8082331B8E8C603271D777197939B5E7360EB02780D46017A76EE6456748F20
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.6.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2B6F.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4594
Entropy (8bit):	4.458191064051907
Encrypted:	false
SSDEEP:	48:cvIwWl8zsn6uJg77aI9PcrWpW8VYfYm8M4J1PR5FLvo+q8Ya6JTzzMhQd:uIjfn6kI7td7VbJnoDJTzzMhQd
MD5:	BC27CBBE1E8AC72BF78D7B2DE30DCBA5
SHA1:	B6EA36BDC11A1464DADF776D542831B6D6BDF4A2
SHA-256:	DD84E016BB9790885EB2B33B50C7B9C201C0BBDDE98907208A00BA4E68DB23EA
SHA-512:	ECC91321166DF813A2DE8F75AEA06DC5757F3EFAF4E25008905BE0033432C75B0A30A52579C0247B7899EA0E5897EDE2C50BE8610C1D60F0159FF107AD136DB0
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="643523" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.372104109850364
Encrypted:	false
SSDEEP:	6144:SFVfpi6ceLP/9skLmb0ayWWSPtaJG8nAge35OlMMhA2AX4WABlguNliL:6V1QyWWI/glMM6kF7nq
MD5:	75AC5C3EFD2BB732F2CC89956F3F7362
SHA1:	40A8B4EACBCF63E80813BF17DFC00CF6BD571C7B
SHA-256:	0193FC9BA1F3B9EB3D3F0937214CB5D722923F82992CE1F8D16B88DDBC135A99
SHA-512:	503A7B8999DEFDDB5FD70BA2727CAFE11A893A1503EDDC679E261955637F2A4E25D40788ECB7E5F1D25894279AA6CE66DC80C72542DE65309CBA3FDFF052BDE6
Malicious:	false
Reputation:	low
Preview:	regfC...C....\.Z.................... ....0......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.....U.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	7.982500568866145
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	uwa78qqv0x.exe
File size:	4'478'464 bytes
MD5:	1f26197a5239abd7c93b7dc95c79f102
SHA1:	68849610394a573c7ed15ba0cd9200f10de9b435
SHA256:	d9be895942e95e3c06b9295b1aaabe89d5ba4a1e5e33ccdb2efec7806cd216a1
SHA512:	d6e70f4b866b346a6afc6377a61cc5de59b834997efc2c1a75f2f06b0e5f73bc28b034a343cdaf3337c2882e0facbf551f996cc4954168310063933461b18de7
SSDEEP:	98304:n32UcwY/i4wMi12Ss/Y1dryPOPNTVxmdv8XM9CCH5aYdA73wYTCw:n3Yw7Mi12k1/NTmZCy5aaMgO
TLSH:	4E2633719DF4E203D8E9F933165A5214087EA140F2FFDAE5386E3175E4AE2182B42BD7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....cg...............(.VH...v..2...........pH...@..................................<E...@... ............................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x1098000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:	DYNAMIC_BASE
Time Stamp:	0x67639809 [Thu Dec 19 03:50:33 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F43D0BC6ECAh
sysenter
inc esp
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x74705f	0x73	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x746000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc96b1c	0x10	gzrpzaat
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc96acc	0x18	gzrpzaat
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x745000	0x284c00	83475c1866f4db4c464dc04b841262e0	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x746000	0x1ac	0x200	371a60d2331519e95340782549d971db	False	0.58203125	data	4.546255798843472	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x747000	0x1000	0x200	e84636d45557e74dadd0f14f36394655	False	0.166015625	data	1.1471680400846989	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x748000	0x392000	0x200	a1da20bdf590c80bc90e4cb82844184c	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
gzrpzaat	0xada000	0x1bd000	0x1bce00	892079d96fcb7e2f311e5109190468f2	False	0.9942267842090475	data	7.955149229409411	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
usdkjmbf	0xc97000	0x1000	0x400	ded761a0a9b75c15b7b733e305828883	False	0.8095703125	data	6.243385344734937	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0xc98000	0x3000	0x2200	38bbbd9914825c5c1254cd091aef784d	False	0.06629136029411764	DOS executable (COM)	0.7483708347772204	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0xc96b2c	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 07:21:04.281796932 CET	49705	443	192.168.2.8	98.85.100.80
Dec 23, 2024 07:21:04.281835079 CET	443	49705	98.85.100.80	192.168.2.8
Dec 23, 2024 07:21:04.281903028 CET	49705	443	192.168.2.8	98.85.100.80
Dec 23, 2024 07:21:04.293442011 CET	49705	443	192.168.2.8	98.85.100.80
Dec 23, 2024 07:21:04.293453932 CET	443	49705	98.85.100.80	192.168.2.8
Dec 23, 2024 07:21:06.041538000 CET	443	49705	98.85.100.80	192.168.2.8
Dec 23, 2024 07:21:06.042156935 CET	49705	443	192.168.2.8	98.85.100.80
Dec 23, 2024 07:21:06.042179108 CET	443	49705	98.85.100.80	192.168.2.8
Dec 23, 2024 07:21:06.044122934 CET	443	49705	98.85.100.80	192.168.2.8
Dec 23, 2024 07:21:06.044203043 CET	49705	443	192.168.2.8	98.85.100.80
Dec 23, 2024 07:21:06.045630932 CET	49705	443	192.168.2.8	98.85.100.80
Dec 23, 2024 07:21:06.045731068 CET	443	49705	98.85.100.80	192.168.2.8
Dec 23, 2024 07:21:06.054932117 CET	49705	443	192.168.2.8	98.85.100.80
Dec 23, 2024 07:21:06.054949999 CET	443	49705	98.85.100.80	192.168.2.8
Dec 23, 2024 07:21:06.109196901 CET	49705	443	192.168.2.8	98.85.100.80
Dec 23, 2024 07:21:06.375509024 CET	443	49705	98.85.100.80	192.168.2.8
Dec 23, 2024 07:21:06.375860929 CET	443	49705	98.85.100.80	192.168.2.8
Dec 23, 2024 07:21:06.375927925 CET	49705	443	192.168.2.8	98.85.100.80
Dec 23, 2024 07:21:06.466491938 CET	49705	443	192.168.2.8	98.85.100.80
Dec 23, 2024 07:21:06.466521978 CET	443	49705	98.85.100.80	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 07:21:03.992253065 CET	63786	53	192.168.2.8	1.1.1.1
Dec 23, 2024 07:21:03.992398977 CET	63786	53	192.168.2.8	1.1.1.1
Dec 23, 2024 07:21:04.129530907 CET	53	63786	1.1.1.1	192.168.2.8
Dec 23, 2024 07:21:04.279503107 CET	53	63786	1.1.1.1	192.168.2.8
Dec 23, 2024 07:21:07.464904070 CET	63789	53	192.168.2.8	1.1.1.1
Dec 23, 2024 07:21:07.464967966 CET	63789	53	192.168.2.8	1.1.1.1
Dec 23, 2024 07:21:07.884435892 CET	53	63789	1.1.1.1	192.168.2.8
Dec 23, 2024 07:21:08.139425993 CET	53	63789	1.1.1.1	192.168.2.8
Dec 23, 2024 07:21:08.341078043 CET	63790	53	192.168.2.8	1.1.1.1
Dec 23, 2024 07:21:08.341136932 CET	63790	53	192.168.2.8	1.1.1.1
Dec 23, 2024 07:21:08.478630066 CET	53	63790	1.1.1.1	192.168.2.8
Dec 23, 2024 07:21:08.478882074 CET	53	63790	1.1.1.1	192.168.2.8
Dec 23, 2024 07:21:08.689363003 CET	63791	53	192.168.2.8	1.1.1.1
Dec 23, 2024 07:21:08.689419985 CET	63791	53	192.168.2.8	1.1.1.1
Dec 23, 2024 07:21:08.827733040 CET	53	63791	1.1.1.1	192.168.2.8
Dec 23, 2024 07:21:08.827754021 CET	53	63791	1.1.1.1	192.168.2.8
Dec 23, 2024 07:21:09.414277077 CET	63792	53	192.168.2.8	1.1.1.1
Dec 23, 2024 07:21:09.414532900 CET	63792	53	192.168.2.8	1.1.1.1
Dec 23, 2024 07:21:09.552001953 CET	53	63792	1.1.1.1	192.168.2.8
Dec 23, 2024 07:21:09.552038908 CET	53	63792	1.1.1.1	192.168.2.8
Dec 23, 2024 07:21:09.711577892 CET	63793	53	192.168.2.8	1.1.1.1
Dec 23, 2024 07:21:09.711633921 CET	63793	53	192.168.2.8	1.1.1.1
Dec 23, 2024 07:21:09.848834991 CET	53	63793	1.1.1.1	192.168.2.8
Dec 23, 2024 07:21:09.848901987 CET	53	63793	1.1.1.1	192.168.2.8
Dec 23, 2024 07:21:10.035007000 CET	63794	53	192.168.2.8	1.1.1.1
Dec 23, 2024 07:21:10.035065889 CET	63794	53	192.168.2.8	1.1.1.1
Dec 23, 2024 07:21:10.173057079 CET	53	63794	1.1.1.1	192.168.2.8
Dec 23, 2024 07:21:10.173131943 CET	53	63794	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 23, 2024 07:21:03.992253065 CET	192.168.2.8	1.1.1.1	0x1c8f	Standard query (0)	httpbin.org	A (IP address)	IN (0x0001)	false
Dec 23, 2024 07:21:03.992398977 CET	192.168.2.8	1.1.1.1	0xb82d	Standard query (0)	httpbin.org	28	IN (0x0001)	false
Dec 23, 2024 07:21:07.464904070 CET	192.168.2.8	1.1.1.1	0xa2ef	Standard query (0)	home.fivetk5ht.top	A (IP address)	IN (0x0001)	false
Dec 23, 2024 07:21:07.464967966 CET	192.168.2.8	1.1.1.1	0x4fe8	Standard query (0)	home.fivetk5ht.top	28	IN (0x0001)	false
Dec 23, 2024 07:21:08.341078043 CET	192.168.2.8	1.1.1.1	0x2f53	Standard query (0)	home.fivetk5ht.top	A (IP address)	IN (0x0001)	false
Dec 23, 2024 07:21:08.341136932 CET	192.168.2.8	1.1.1.1	0xaf25	Standard query (0)	home.fivetk5ht.top	28	IN (0x0001)	false
Dec 23, 2024 07:21:08.689363003 CET	192.168.2.8	1.1.1.1	0x4f5d	Standard query (0)	home.fivetk5ht.top	A (IP address)	IN (0x0001)	false
Dec 23, 2024 07:21:08.689419985 CET	192.168.2.8	1.1.1.1	0x71d7	Standard query (0)	home.fivetk5ht.top	28	IN (0x0001)	false
Dec 23, 2024 07:21:09.414277077 CET	192.168.2.8	1.1.1.1	0x26f8	Standard query (0)	home.fivetk5ht.top	A (IP address)	IN (0x0001)	false
Dec 23, 2024 07:21:09.414532900 CET	192.168.2.8	1.1.1.1	0x990	Standard query (0)	home.fivetk5ht.top	28	IN (0x0001)	false
Dec 23, 2024 07:21:09.711577892 CET	192.168.2.8	1.1.1.1	0x102c	Standard query (0)	home.fivetk5ht.top	A (IP address)	IN (0x0001)	false
Dec 23, 2024 07:21:09.711633921 CET	192.168.2.8	1.1.1.1	0x87db	Standard query (0)	home.fivetk5ht.top	28	IN (0x0001)	false
Dec 23, 2024 07:21:10.035007000 CET	192.168.2.8	1.1.1.1	0xdf85	Standard query (0)	home.fivetk5ht.top	A (IP address)	IN (0x0001)	false
Dec 23, 2024 07:21:10.035065889 CET	192.168.2.8	1.1.1.1	0x4be8	Standard query (0)	home.fivetk5ht.top	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 23, 2024 07:21:04.279503107 CET	1.1.1.1	192.168.2.8	0x1c8f	No error (0)	httpbin.org		98.85.100.80	A (IP address)	IN (0x0001)	false
Dec 23, 2024 07:21:04.279503107 CET	1.1.1.1	192.168.2.8	0x1c8f	No error (0)	httpbin.org		34.226.108.155	A (IP address)	IN (0x0001)	false
Dec 23, 2024 07:21:07.884435892 CET	1.1.1.1	192.168.2.8	0xa2ef	Name error (3)	home.fivetk5ht.top	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 07:21:08.139425993 CET	1.1.1.1	192.168.2.8	0x4fe8	Name error (3)	home.fivetk5ht.top	none	none	28	IN (0x0001)	false
Dec 23, 2024 07:21:08.478630066 CET	1.1.1.1	192.168.2.8	0x2f53	Name error (3)	home.fivetk5ht.top	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 07:21:08.478882074 CET	1.1.1.1	192.168.2.8	0xaf25	Name error (3)	home.fivetk5ht.top	none	none	28	IN (0x0001)	false
Dec 23, 2024 07:21:08.827733040 CET	1.1.1.1	192.168.2.8	0x4f5d	Name error (3)	home.fivetk5ht.top	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 07:21:08.827754021 CET	1.1.1.1	192.168.2.8	0x71d7	Name error (3)	home.fivetk5ht.top	none	none	28	IN (0x0001)	false
Dec 23, 2024 07:21:09.552001953 CET	1.1.1.1	192.168.2.8	0x990	Name error (3)	home.fivetk5ht.top	none	none	28	IN (0x0001)	false
Dec 23, 2024 07:21:09.552038908 CET	1.1.1.1	192.168.2.8	0x26f8	Name error (3)	home.fivetk5ht.top	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 07:21:09.848834991 CET	1.1.1.1	192.168.2.8	0x87db	Name error (3)	home.fivetk5ht.top	none	none	28	IN (0x0001)	false
Dec 23, 2024 07:21:09.848901987 CET	1.1.1.1	192.168.2.8	0x102c	Name error (3)	home.fivetk5ht.top	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 07:21:10.173057079 CET	1.1.1.1	192.168.2.8	0x4be8	Name error (3)	home.fivetk5ht.top	none	none	28	IN (0x0001)	false
Dec 23, 2024 07:21:10.173131943 CET	1.1.1.1	192.168.2.8	0xdf85	Name error (3)	home.fivetk5ht.top	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

httpbin.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	98.85.100.80	443	7616	C:\Users\user\Desktop\uwa78qqv0x.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:21:06 UTC	52	OUT	GET /ip HTTP/1.1 Host: httpbin.org Accept: /
2024-12-23 06:21:06 UTC	224	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 06:21:06 GMT Content-Type: application/json Content-Length: 31 Connection: close Server: gunicorn/19.9.0 Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true
2024-12-23 06:21:06 UTC	31	IN	Data Raw: 7b 0a 20 20 22 6f 72 69 67 69 6e 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 0a 7d 0a Data Ascii: { "origin": "8.46.123.189"}

Target ID:	0
Start time:	01:21:01
Start date:	23/12/2024
Path:	C:\Users\user\Desktop\uwa78qqv0x.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\uwa78qqv0x.exe"
Imagebase:	0xee0000
File size:	4'478'464 bytes
MD5 hash:	1F26197A5239ABD7C93B7DC95C79F102
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:21:09
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7616 -s 1136
Imagebase:	0x470000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	9
Total number of Limit Nodes:	1

Executed Functions

Function 07100A41 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634796721.0000000007100000.00000040.00001000.00020000.00000000.sdmp, Offset: 07100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7100000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6944cb1ea71b154451fa40b6a23a67a9af10a594927414fd9d39948f119ca54b
Instruction ID: 24e5b01645dc296928de6bbd243dff2a3e50ecee4e8728329c799badabb8a468
Opcode Fuzzy Hash: 6944cb1ea71b154451fa40b6a23a67a9af10a594927414fd9d39948f119ca54b
Instruction Fuzzy Hash: B621F6FB16C219FDA10AD9815750BFA636DDADF230F328466F40BA21C2D3D10B5946F1

Function 07170136 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

kZX3, xrefs: 07170148

Memory Dump Source

Source File: 00000000.00000002.1634905629.0000000007170000.00000040.00001000.00020000.00000000.sdmp, Offset: 07170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7170000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID: kZX3
API String ID: 0-1643819570
Opcode ID: fe3bdf27aa84b0744d479caa4a128cc6baf307b5af2f920f78c592d1687e186e
Instruction ID: 7fdcac02a4baec38439c814e1ec865f28538de425f4af3f5765dbfbd94f09b92
Opcode Fuzzy Hash: fe3bdf27aa84b0744d479caa4a128cc6baf307b5af2f920f78c592d1687e186e
Instruction Fuzzy Hash: 9861B0FB16C210BDB106C1556F54AFB677EE2CB730B32852AF807C65C2E3984A4E9171

Function 07170170 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 302
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

kZX3, xrefs: 07170148

Memory Dump Source

Source File: 00000000.00000002.1634905629.0000000007170000.00000040.00001000.00020000.00000000.sdmp, Offset: 07170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7170000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID: kZX3
API String ID: 0-1643819570
Opcode ID: 825df0767f973e81df2aee873d8ce89eb22460f22a3a8bcb45edbc534037a51e
Instruction ID: 3fab9a815a2f133ab9f0f327bed53cc700b0b280c00ee911250e3a25b68b5da0
Opcode Fuzzy Hash: 825df0767f973e81df2aee873d8ce89eb22460f22a3a8bcb45edbc534037a51e
Instruction Fuzzy Hash: B551C4EB15C321BDB10681556F54AFB6B7EE2DF730B32852AF407C65C2E3944A4E8171

Function 07110C90 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 266
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLogicalDrives.KERNELBASE ref: 07110D63

Strings

A:\, xrefs: 07110EEB, 07110F12

Memory Dump Source

Source File: 00000000.00000002.1634811066.0000000007110000.00000040.00001000.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_uwa78qqv0x.jbxd

Similarity

API ID: DrivesLogical
String ID: A:\
API String ID: 999431828-3379428675
Opcode ID: 0ed9617272a4f1706bcd650599106292a0f9d841b218654624a0623c7bc7585e
Instruction ID: 02c889d55a105631cd0b3c03cc383c82e71e1672d5810b37601cd4b3bb3499da
Opcode Fuzzy Hash: 0ed9617272a4f1706bcd650599106292a0f9d841b218654624a0623c7bc7585e
Instruction Fuzzy Hash: 0B513AEBA1D2517DB70684912B549FB6B6EE4CB730732C47BF803DA182E3C58D8A5131

Function 07110C88 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 243
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLogicalDrives.KERNELBASE ref: 07110D63

Strings

A:\, xrefs: 07110EEB, 07110F12

Memory Dump Source

Source File: 00000000.00000002.1634811066.0000000007110000.00000040.00001000.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_uwa78qqv0x.jbxd

Similarity

API ID: DrivesLogical
String ID: A:\
API String ID: 999431828-3379428675
Opcode ID: 588aeb256dfaaada190617334d09d1a8efcd80e1baf2136f5b698b6199d26264
Instruction ID: 1f1b510499d1ca2e106ff75c1169bfb564f50da867833aa32260efa5fe29ba57
Opcode Fuzzy Hash: 588aeb256dfaaada190617334d09d1a8efcd80e1baf2136f5b698b6199d26264
Instruction Fuzzy Hash: 2A41F7EBA2D1157D764A81922B549FB2B6EE4CB730732C47BF803DD182E7C58E8A5131

Function 07110CC6 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 232
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLogicalDrives.KERNELBASE ref: 07110D63

Strings

A:\, xrefs: 07110EEB, 07110F12

Memory Dump Source

Source File: 00000000.00000002.1634811066.0000000007110000.00000040.00001000.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_uwa78qqv0x.jbxd

Similarity

API ID: DrivesLogical
String ID: A:\
API String ID: 999431828-3379428675
Opcode ID: 643bcc1a3862f8e01b2056442fc629b19341a3941dd4d4367b3593da9233362a
Instruction ID: c18200f4b765d598155dbd0968d3e144dc56573c3f432fc95d30a24e02d347db
Opcode Fuzzy Hash: 643bcc1a3862f8e01b2056442fc629b19341a3941dd4d4367b3593da9233362a
Instruction Fuzzy Hash: D741E7EB65D1157D720A90922B549FB2B6EE4CB730731C47BF803DE182E7C58E8A1131

Function 07110D19 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLogicalDrives.KERNELBASE ref: 07110D63

Strings

A:\, xrefs: 07110EEB, 07110F12

Memory Dump Source

Source File: 00000000.00000002.1634811066.0000000007110000.00000040.00001000.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_uwa78qqv0x.jbxd

Similarity

API ID: DrivesLogical
String ID: A:\
API String ID: 999431828-3379428675
Opcode ID: dffff9da0ca06f18d2e45f45a20f6c0ff064d551f399d43af12e1c39d3d258b6
Instruction ID: 77b14fa70aa4b6afe10793375239c6f8bd60e39623a095f4f3166338d730f93f
Opcode Fuzzy Hash: dffff9da0ca06f18d2e45f45a20f6c0ff064d551f399d43af12e1c39d3d258b6
Instruction Fuzzy Hash: D34116EBA1E2157D724A94962B549FB2B6ED4CB630731C47AF803DE182E7C18D8A5131

Function 07110D05 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 189
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLogicalDrives.KERNELBASE ref: 07110D63

Strings

A:\, xrefs: 07110EEB, 07110F12

Memory Dump Source

Source File: 00000000.00000002.1634811066.0000000007110000.00000040.00001000.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_uwa78qqv0x.jbxd

Similarity

API ID: DrivesLogical
String ID: A:\
API String ID: 999431828-3379428675
Opcode ID: 3c9f8e29609a64f27802b54899c0a39eeced7a95e1fe00f8daae0308e8f4caee
Instruction ID: fade6709b930384d05fd924e66aa5b1dd270dfb8cdc534ab381b28b3e3ff2308
Opcode Fuzzy Hash: 3c9f8e29609a64f27802b54899c0a39eeced7a95e1fe00f8daae0308e8f4caee
Instruction Fuzzy Hash: 0C312AEBA1E115BD364A84922B509FB2B6EE4CF630731C47BF803DE182E7C18D8A5131

Function 07110D5D Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 165
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLogicalDrives.KERNELBASE ref: 07110D63

Strings

A:\, xrefs: 07110EEB, 07110F12

Memory Dump Source

Source File: 00000000.00000002.1634811066.0000000007110000.00000040.00001000.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_uwa78qqv0x.jbxd

Similarity

API ID: DrivesLogical
String ID: A:\
API String ID: 999431828-3379428675
Opcode ID: df507f27b8cd5927bf1aaf9a98a6ce6a88394c7aecfff5535b4f840581f3c268
Instruction ID: d40ecf2cc243b06ba32acd6560ad7cd315269ef86f6abba72ed160737608c268
Opcode Fuzzy Hash: df507f27b8cd5927bf1aaf9a98a6ce6a88394c7aecfff5535b4f840581f3c268
Instruction Fuzzy Hash: 5831D7EBA1E115BD724A94962B509FB276ED4CB630731C47BF903DE181E7C18D8A5131

Function 0717003B Relevance: 1.9, APIs: 1, Instructions: 366
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1634905629.0000000007170000.00000040.00001000.00020000.00000000.sdmp, Offset: 07170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7170000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a572d82eba5cb6f3181d65b05d799c81a9d1e7bac0859479a6db8b11c8d8e2e9
Instruction ID: 7b6ecde58b87adc09e0bdc56e1cc9c0a4cb341f4fdc33e735a058aeb328f5ead
Opcode Fuzzy Hash: a572d82eba5cb6f3181d65b05d799c81a9d1e7bac0859479a6db8b11c8d8e2e9
Instruction Fuzzy Hash: DD616FFB16D221BD710AC5466F64AFB577EE2DB730B32842AF807C55C2E3984A4E9131

Function 07170034 Relevance: 1.8, APIs: 1, Instructions: 343
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1634905629.0000000007170000.00000040.00001000.00020000.00000000.sdmp, Offset: 07170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7170000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 848ef835046c451274eace381c38c6285960d4b017ece267f7d27e175771257e
Instruction ID: 3140504db98b3fab35abf13a46e2229446aca6a80967b3d6cb3fd23fdd62d1d0
Opcode Fuzzy Hash: 848ef835046c451274eace381c38c6285960d4b017ece267f7d27e175771257e
Instruction Fuzzy Hash: AC615CEB16D221BD714AC1466F64AFB577EE2DB730B32842AF807C65C2E3984A4D9131

Function 07170046 Relevance: 1.8, APIs: 1, Instructions: 341
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1634905629.0000000007170000.00000040.00001000.00020000.00000000.sdmp, Offset: 07170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7170000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 397b559608228da8ce4a6fc6e063e119a7680fb9569a49e2060fd7cb19027cef
Instruction ID: 122d6f9fcf3f3a95dce85b509e322e65add42f733c4f2113050fda208793a05b
Opcode Fuzzy Hash: 397b559608228da8ce4a6fc6e063e119a7680fb9569a49e2060fd7cb19027cef
Instruction Fuzzy Hash: 88618FFB16C221BD7106C1466F64AFB577EE2DB730B32842AF807C65C2E3984A4D8171

Function 07170078 Relevance: 1.8, APIs: 1, Instructions: 334
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1634905629.0000000007170000.00000040.00001000.00020000.00000000.sdmp, Offset: 07170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7170000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fd81425fe2c09f6f639c4332e55782557c5a9a14e3ecde73cbb2c226ec7874c
Instruction ID: a95ccc48124341b3ff7b952afea478094b3b9b655d8c95d9fc76559c0922d3f9
Opcode Fuzzy Hash: 1fd81425fe2c09f6f639c4332e55782557c5a9a14e3ecde73cbb2c226ec7874c
Instruction Fuzzy Hash: CC6181FB16D221BDB106C1456F64AFB577EE2DB730B32842AF807C65C2E3994A4D9131

Function 07170060 Relevance: 1.8, APIs: 1, Instructions: 333
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1634905629.0000000007170000.00000040.00001000.00020000.00000000.sdmp, Offset: 07170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7170000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 360f6d98b5392048fd04bd70937c3d22c5e9bd662217d393ebc50be84d7f51d4
Instruction ID: e86c826e1796d6e804f562aa95f481ef593803db73cb1896f978a34d9faa1df4
Opcode Fuzzy Hash: 360f6d98b5392048fd04bd70937c3d22c5e9bd662217d393ebc50be84d7f51d4
Instruction Fuzzy Hash: 19516EFB16D220BD714AC1466F64AFB577EE2DB730B32852AF807C65C2E3984A4D9131

Function 071700A5 Relevance: 1.8, APIs: 1, Instructions: 316
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1634905629.0000000007170000.00000040.00001000.00020000.00000000.sdmp, Offset: 07170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7170000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a25d9d9f37800db40fab319f5a2ae771c27004e4ef4a0bade693e5dba2319c94
Instruction ID: 678c947e6bfd92f1321f993896cf85df9c473584bb7081af69684ea6136dc529
Opcode Fuzzy Hash: a25d9d9f37800db40fab319f5a2ae771c27004e4ef4a0bade693e5dba2319c94
Instruction Fuzzy Hash: 13515EEB16D220BD714AC1466F64AFB577EE2DB730B32852BF807C65C2E3984A4D9131

Function 071700B8 Relevance: 1.8, APIs: 1, Instructions: 305
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1634905629.0000000007170000.00000040.00001000.00020000.00000000.sdmp, Offset: 07170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7170000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7c5c31fd00d6477fab959f2f2ba1a83405a98f19ced225dc544a22077c6404d
Instruction ID: 92f098f99c9e92bb6c795e7c3e7dd17af447febe1ff54ea74fe0681cdccd92a7
Opcode Fuzzy Hash: f7c5c31fd00d6477fab959f2f2ba1a83405a98f19ced225dc544a22077c6404d
Instruction Fuzzy Hash: A6519EEB16C220BD714AC5466F64AFB577EE2DF730B32852AF807C25C2E3984A4D9131

Function 071700D6 Relevance: 1.8, APIs: 1, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634905629.0000000007170000.00000040.00001000.00020000.00000000.sdmp, Offset: 07170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7170000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53d7c7ad9e868c63a61b66427a7cfcd914c5b10d6fbc2b57851bb435d506c416
Instruction ID: 3e3c03bcd859a0fc6a59f47ca34edee8090ea0725e07c448102a64055cac6382
Opcode Fuzzy Hash: 53d7c7ad9e868c63a61b66427a7cfcd914c5b10d6fbc2b57851bb435d506c416
Instruction Fuzzy Hash: 93516DFB16D220BD714AC1466F64AFB577EE2DB730B32852AF807C65C2E3984A4D9131

Function 071700FC Relevance: 1.8, APIs: 1, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634905629.0000000007170000.00000040.00001000.00020000.00000000.sdmp, Offset: 07170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7170000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e5b0555a3b26b7893db9bcebf44847eb409e61d09b2acebd62bd47e24931c35
Instruction ID: 34c4ab014cfb70eac060f6164509bb5cec0cd607e72878f49d01cde8e54a7471
Opcode Fuzzy Hash: 5e5b0555a3b26b7893db9bcebf44847eb409e61d09b2acebd62bd47e24931c35
Instruction Fuzzy Hash: A2518DEB16C220BD714AC1456F64AFB677EE2DF730B32852AF807C65C2E3984A4D9171

Function 0717011C Relevance: 1.8, APIs: 1, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634905629.0000000007170000.00000040.00001000.00020000.00000000.sdmp, Offset: 07170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7170000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 495c64c04ccb34e34eb42ba326cd467a0122417e5fabd2b3be6d0af76c8b5be2
Instruction ID: 7a9408cdacb52ea349ddbcd7e151377b541d059fccf8fb078f741f7e0b1f1bcf
Opcode Fuzzy Hash: 495c64c04ccb34e34eb42ba326cd467a0122417e5fabd2b3be6d0af76c8b5be2
Instruction Fuzzy Hash: 9F517EEB16C220BD714AC5456F64AFB577EE2DF730B32852AF807C66C2E3984A4D9131

Function 0716010E Relevance: 1.8, APIs: 1, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634890803.0000000007160000.00000040.00001000.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 497e4526f6b428c70e1e33626fe842198737ea32de982dd57e509803608a0107
Instruction ID: 8e13d120a6152abbb5f719c7ef750d3edf32ca32a2cef9549debed281bbb6c79
Opcode Fuzzy Hash: 497e4526f6b428c70e1e33626fe842198737ea32de982dd57e509803608a0107
Instruction Fuzzy Hash: A75106EB16C121BD711E81511F5CEFA5B6EE5DB730B32842AB807D66C2F3944EAA4031

Function 071600DA Relevance: 1.8, APIs: 1, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634890803.0000000007160000.00000040.00001000.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_uwa78qqv0x.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: 3bcce7bfd3289579110996236f0831aa062667cdefdc858b6ac321fd9e187aa3
Instruction ID: 1d3e302a478d7d950fd02b3f76e514593fecd7ef8190226fe0cccc522ba76b8a
Opcode Fuzzy Hash: 3bcce7bfd3289579110996236f0831aa062667cdefdc858b6ac321fd9e187aa3
Instruction Fuzzy Hash: A751F6EB16C111BD711A81551F5CEFA5B2EE6DB731B32842AB807D66C2F3944FAA4031

Function 0717019D Relevance: 1.8, APIs: 1, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634905629.0000000007170000.00000040.00001000.00020000.00000000.sdmp, Offset: 07170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7170000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 561523d84aab605d7e867c5dddbc7a60063bf2165759da7d54af2e2d4a445ebd
Instruction ID: 15b0adef492e07c3df24f0631d98d025a7b4e95a3513168907af1cd7026fc740
Opcode Fuzzy Hash: 561523d84aab605d7e867c5dddbc7a60063bf2165759da7d54af2e2d4a445ebd
Instruction Fuzzy Hash: 6E51B3EB16D320BDB14A81552F55AFB577EE2DB730B32842AF807C29C2E3980A4D9131

Function 071600F5 Relevance: 1.8, APIs: 1, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634890803.0000000007160000.00000040.00001000.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_uwa78qqv0x.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: d1c88fb494ccde41230ed408703e55871d8c8df284b87249a8399902e7b58334
Instruction ID: f9bde141c1c12198705e97aa92a556b8b8fd114368bb52d290571100cbbf5a15
Opcode Fuzzy Hash: d1c88fb494ccde41230ed408703e55871d8c8df284b87249a8399902e7b58334
Instruction Fuzzy Hash: 3E51D6EB16C121BDB15A81412F1CEF6576EE6DB731F32842AB807D66C2F3944FAA5031

Function 071600D4 Relevance: 1.8, APIs: 1, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634890803.0000000007160000.00000040.00001000.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_uwa78qqv0x.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: 37872fb9bd46954ce9f9734bcdba2a2727155fe71ed35e396749ac22212f0025
Instruction ID: da5a423bb5e4a80d6a21ba63540d1e89f3054f5da3e9f082177c635c97840fca
Opcode Fuzzy Hash: 37872fb9bd46954ce9f9734bcdba2a2727155fe71ed35e396749ac22212f0025
Instruction Fuzzy Hash: 8451F6EB16C121BD715A81411B1CEFA572EE5DB730F32842AB807D66C2E3984FAA4031

Function 07160120 Relevance: 1.7, APIs: 1, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634890803.0000000007160000.00000040.00001000.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe99ab26ac28b4fd452f819307b5216f9df9b4d0b419d87aabcd86e59119ed01
Instruction ID: 534cd258246027f38f981c42e70f26de424b9e4b71c60d5691bf8eede666d23c
Opcode Fuzzy Hash: fe99ab26ac28b4fd452f819307b5216f9df9b4d0b419d87aabcd86e59119ed01
Instruction Fuzzy Hash: 6D4108EB16C120BD715B80512B5CEF6576EE5DF731B33842AB807D66C2E3984FAA4031

Function 071701D7 Relevance: 1.7, APIs: 1, Instructions: 232COMMON

Download Yara Rule

APIs

Process32NextW.KERNEL32(00006C3F,00006C3F,?,?), ref: 07170472

Memory Dump Source

Source File: 00000000.00000002.1634905629.0000000007170000.00000040.00001000.00020000.00000000.sdmp, Offset: 07170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7170000_uwa78qqv0x.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 943ddf4d47fb8ec26cc3bb2379553433913c90e53d29e26a3d2bc4a9b56fd3a4
Instruction ID: 7dc206335db7accbc419840a927610c1f559c7e1ebc41c6e880ab48bae2fab19
Opcode Fuzzy Hash: 943ddf4d47fb8ec26cc3bb2379553433913c90e53d29e26a3d2bc4a9b56fd3a4
Instruction Fuzzy Hash: 9F415EEB16C221BD714A81466F64AFB567EE2DF730B328526F807C55C2E3984A4D9031

Function 0716013A Relevance: 1.7, APIs: 1, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634890803.0000000007160000.00000040.00001000.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_uwa78qqv0x.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: 9f5b9129c5545d415536b91c665a07316633e530fe00c1dd374d2a8542009f91
Instruction ID: accf4e5dfb4015e55d6f591a13ddd7863962c824119449125e9fb7aafef42fad
Opcode Fuzzy Hash: 9f5b9129c5545d415536b91c665a07316633e530fe00c1dd374d2a8542009f91
Instruction Fuzzy Hash: 254119EB16C110BDB15A81512F1CEFA5B2EE5DF731B328426B807D66C2E3D44F6A4031

Function 071701E4 Relevance: 1.7, APIs: 1, Instructions: 227COMMON

Download Yara Rule

APIs

Process32NextW.KERNEL32(00006C3F,00006C3F,?,?), ref: 07170472

Memory Dump Source

Source File: 00000000.00000002.1634905629.0000000007170000.00000040.00001000.00020000.00000000.sdmp, Offset: 07170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7170000_uwa78qqv0x.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 5ab6e3892cbeb4b0b8df4add89f7ab5e2da71cb0f4c5f2b6882e70d18bd6bafc
Instruction ID: 8ab6a40160d8862545fc683a686863cffa4e37a6c466f49ae404d46fdefbee8a
Opcode Fuzzy Hash: 5ab6e3892cbeb4b0b8df4add89f7ab5e2da71cb0f4c5f2b6882e70d18bd6bafc
Instruction Fuzzy Hash: F5418FFB16C221BDB14A81466F64AFB577EE2DF730B328526F407C65C2E3980A4D9171

Function 071601B7 Relevance: 1.7, APIs: 1, Instructions: 223COMMON

Download Yara Rule

APIs

Process32FirstW.KERNEL32(0000CD2F,0000CD2F,0000CD2F,?), ref: 07160377

Memory Dump Source

Source File: 00000000.00000002.1634890803.0000000007160000.00000040.00001000.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_uwa78qqv0x.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: 76173f4ecab5710ebcc834620fc7f035004e04995369494a6986a3c779f860fb
Instruction ID: 412b8a8edd300f6eb23d3b6a9c60ca0c41935a43e7914db12a9528f944586154
Opcode Fuzzy Hash: 76173f4ecab5710ebcc834620fc7f035004e04995369494a6986a3c779f860fb
Instruction Fuzzy Hash: 6F4150E715C110BDB25B81511B1CEF66B2EE6DB730B32846BF807D66C3E3980E694131

Function 07160163 Relevance: 1.7, APIs: 1, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634890803.0000000007160000.00000040.00001000.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_uwa78qqv0x.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: aabfea65b8bda8c582aadb5ac5207718ad747f152ffe5ff457b99e07a5bb5dc9
Instruction ID: 812715f076d4d73fee2b061e2676ec96f5ee22bd9710ddea677c56c60645c62a
Opcode Fuzzy Hash: aabfea65b8bda8c582aadb5ac5207718ad747f152ffe5ff457b99e07a5bb5dc9
Instruction Fuzzy Hash: B6411BEB16C110BDB15A81511B5CEFA5B2FE6DF731F32842AB807D66C2E3944B6A4131

Function 07170210 Relevance: 1.7, APIs: 1, Instructions: 216COMMON

Download Yara Rule

APIs

Process32NextW.KERNEL32(00006C3F,00006C3F,?,?), ref: 07170472

Memory Dump Source

Source File: 00000000.00000002.1634905629.0000000007170000.00000040.00001000.00020000.00000000.sdmp, Offset: 07170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7170000_uwa78qqv0x.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 61d54db8a31dac39f2c731e27891e1d96c8914a25030006d9976ab2377911f19
Instruction ID: f08a70b3975e91e598736d76f5ea839fc0e5e03995b28d3500d4a217cbe92c3a
Opcode Fuzzy Hash: 61d54db8a31dac39f2c731e27891e1d96c8914a25030006d9976ab2377911f19
Instruction Fuzzy Hash: 1741B0FB16C310BEA14A81556F65AFB577EE2DF730F328526F407D66C2E3980A498031

Function 071701FF Relevance: 1.7, APIs: 1, Instructions: 216COMMON

Download Yara Rule

APIs

Process32NextW.KERNEL32(00006C3F,00006C3F,?,?), ref: 07170472

Memory Dump Source

Source File: 00000000.00000002.1634905629.0000000007170000.00000040.00001000.00020000.00000000.sdmp, Offset: 07170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7170000_uwa78qqv0x.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 8ee85e40c8cd0a9484f9c8b0b71f3e98d756fa6f36cd61fc78e9a8dee1e13d41
Instruction ID: 0fbe72f876131e633c34c456af1d8d81510865e1e75b4b6831191000b8c59c2e
Opcode Fuzzy Hash: 8ee85e40c8cd0a9484f9c8b0b71f3e98d756fa6f36cd61fc78e9a8dee1e13d41
Instruction Fuzzy Hash: AD4180FB1AC320BD714A81456F54AFB567EE2DF730B328426B407C66C2E3980A499031

Function 0716017A Relevance: 1.7, APIs: 1, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634890803.0000000007160000.00000040.00001000.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 629a6a1ac3f1da7e0eb5cb7c93d1878392ff03d87d9fe2b54d3a1d9ab6f90a63
Instruction ID: cb06eeb3e777ffb6a1bf16e3827db4c72f76662127e911d66ee8bc94dc3f49e2
Opcode Fuzzy Hash: 629a6a1ac3f1da7e0eb5cb7c93d1878392ff03d87d9fe2b54d3a1d9ab6f90a63
Instruction Fuzzy Hash: 91412BEB16C111BD711A81511B1CEF6572FE5DF731F32842AB807D6AC2E3984F6A4031

Function 07170280 Relevance: 1.7, APIs: 1, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634905629.0000000007170000.00000040.00001000.00020000.00000000.sdmp, Offset: 07170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7170000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 648588e084113382ef12112ed62aaffc6c61fa84305446b445e729a6e49df925
Instruction ID: c2208d33392298826fe8daa2113ca7522375d0a507a7baab05d1c49386400446
Opcode Fuzzy Hash: 648588e084113382ef12112ed62aaffc6c61fa84305446b445e729a6e49df925
Instruction Fuzzy Hash: C0417FEB1AD220BD714A81456F65AFA567EE2DF730B328526B40BC56C2E3980A4D9131

Function 07160183 Relevance: 1.7, APIs: 1, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634890803.0000000007160000.00000040.00001000.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_uwa78qqv0x.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: 45b37340020c9c819b3f315b9c98b1d0d89a70efb05e42a9a1aea0017a4f2b1a
Instruction ID: 1fb88beedd71a5ea84a5696123bed318059c9ee22887f9410747c3f285355edc
Opcode Fuzzy Hash: 45b37340020c9c819b3f315b9c98b1d0d89a70efb05e42a9a1aea0017a4f2b1a
Instruction Fuzzy Hash: D84129EB16C121BDB11E81511B1CEFA572EE5DF331F328426B807D6AC2E3984E6A4031

Function 07160198 Relevance: 1.7, APIs: 1, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634890803.0000000007160000.00000040.00001000.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_uwa78qqv0x.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: f4c0c8571d9408caf6fb9163a8788336e1620b1e72e2004fb618e6804c27a321
Instruction ID: 9cdbe9c852506f31fa788102221f2c313898402b13d94ad341cc105343d73074
Opcode Fuzzy Hash: f4c0c8571d9408caf6fb9163a8788336e1620b1e72e2004fb618e6804c27a321
Instruction Fuzzy Hash: 29411AE706C121BD711A81511B5CEF65B2EE5DF731B32842AB807D6AC2E3944E6A4031

Function 0717022D Relevance: 1.7, APIs: 1, Instructions: 208COMMON

Download Yara Rule

APIs

Process32NextW.KERNEL32(00006C3F,00006C3F,?,?), ref: 07170472

Memory Dump Source

Source File: 00000000.00000002.1634905629.0000000007170000.00000040.00001000.00020000.00000000.sdmp, Offset: 07170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7170000_uwa78qqv0x.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 28af98a6308eaa0297df870454dc3600175e37dda5ce670d8c7d886a1e1ced62
Instruction ID: dba9ff6a0d0a95d6b6ea2040c8ef3830e8fbdecc7501bf685066d18d8661016b
Opcode Fuzzy Hash: 28af98a6308eaa0297df870454dc3600175e37dda5ce670d8c7d886a1e1ced62
Instruction Fuzzy Hash: 974192FB16C310BE714A85456F65AFB677EE2DF730B328526F407C65C2E3980A499131

Function 0717024A Relevance: 1.7, APIs: 1, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634905629.0000000007170000.00000040.00001000.00020000.00000000.sdmp, Offset: 07170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7170000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 675fee37900a3c85c4cd4cfd5a67ae14ee5ac72653b9a1a3d2ec450565884d08
Instruction ID: ff8c7d30945abee44326aea0ab798b97fe09d74c9b4cf84219960f77cc2bcf0a
Opcode Fuzzy Hash: 675fee37900a3c85c4cd4cfd5a67ae14ee5ac72653b9a1a3d2ec450565884d08
Instruction Fuzzy Hash: 594192EB16C320BDB14A81456F55AFA577EE2DF730B328526F407C66C2E3D80B499031

Function 07170267 Relevance: 1.7, APIs: 1, Instructions: 199COMMON

Download Yara Rule

APIs

Process32NextW.KERNEL32(00006C3F,00006C3F,?,?), ref: 07170472

Memory Dump Source

Source File: 00000000.00000002.1634905629.0000000007170000.00000040.00001000.00020000.00000000.sdmp, Offset: 07170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7170000_uwa78qqv0x.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 64ccca2aedad035a562bf8eed243bc7cfc5191b5d277ef95e5f5f11d1f937b8f
Instruction ID: 2889d9563b68af1b413e5be9464ad4f151fcb2b13e00796fb043354b212d11aa
Opcode Fuzzy Hash: 64ccca2aedad035a562bf8eed243bc7cfc5191b5d277ef95e5f5f11d1f937b8f
Instruction Fuzzy Hash: 2F31C3EB16C320BD714A81456F59AFB567EE2DF730F328526F407C55C2E3D80A499071

Function 07160204 Relevance: 1.7, APIs: 1, Instructions: 184COMMON

Download Yara Rule

APIs

Process32FirstW.KERNEL32(0000CD2F,0000CD2F,0000CD2F,?), ref: 07160377

Memory Dump Source

Source File: 00000000.00000002.1634890803.0000000007160000.00000040.00001000.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_uwa78qqv0x.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: 407832ddbbf57ac9e57b3d86f02f76be3111c7cfe77d5b536218482bb4c0c800
Instruction ID: 8360d72da4f16833c4ece2775d24b796b3d13c4b275a22a616376ba4cbaa3fc1
Opcode Fuzzy Hash: 407832ddbbf57ac9e57b3d86f02f76be3111c7cfe77d5b536218482bb4c0c800
Instruction Fuzzy Hash: 4C31EAEB16C120BD715A80952F5CDF65B1EE5DF731B32841AB807D6AC2E3880FAA5031

Function 0717029E Relevance: 1.7, APIs: 1, Instructions: 184COMMON

Download Yara Rule

APIs

Process32NextW.KERNEL32(00006C3F,00006C3F,?,?), ref: 07170472

Memory Dump Source

Source File: 00000000.00000002.1634905629.0000000007170000.00000040.00001000.00020000.00000000.sdmp, Offset: 07170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7170000_uwa78qqv0x.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 675b99ece27e9d125c6d3373ecb6ab65e689a22ec5f113055de6c19ec0ce5359
Instruction ID: b9715d969ed3d23cfe54762d01b9f83f39db41417bbf4d365c3e3cd7de199bad
Opcode Fuzzy Hash: 675b99ece27e9d125c6d3373ecb6ab65e689a22ec5f113055de6c19ec0ce5359
Instruction Fuzzy Hash: CE3190EB1AD220BDB14A81456F65AFA567EE3DF730F328426B407D59C2E3D80A4D9031

Function 07160213 Relevance: 1.7, APIs: 1, Instructions: 181COMMON

Download Yara Rule

APIs

Process32FirstW.KERNEL32(0000CD2F,0000CD2F,0000CD2F,?), ref: 07160377

Memory Dump Source

Source File: 00000000.00000002.1634890803.0000000007160000.00000040.00001000.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_uwa78qqv0x.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: 630202a0329a431b5d82edc02189200b5dba1cbb9dfc9d266f26d06d60fe8638
Instruction ID: fbbbedf5fa6ffce0eabdf8064bcac201e5f120fd84a56ecf1b6aa91c343cff32
Opcode Fuzzy Hash: 630202a0329a431b5d82edc02189200b5dba1cbb9dfc9d266f26d06d60fe8638
Instruction Fuzzy Hash: 11310BEB16C120BD711E80911F5CDF6171EE5DF731B32841AB807D6AC2E3844FAA5031

Function 071702C3 Relevance: 1.7, APIs: 1, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634905629.0000000007170000.00000040.00001000.00020000.00000000.sdmp, Offset: 07170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7170000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 118a896f1809c09247cb8baa862edffd8f306a59aa379df6e0cc3cf295f677c2
Instruction ID: 87618155abebf44aa06d8bbb2baf30575f061c9295d4934a32ae68808913bbab
Opcode Fuzzy Hash: 118a896f1809c09247cb8baa862edffd8f306a59aa379df6e0cc3cf295f677c2
Instruction Fuzzy Hash: 9A31A0EB1AC2207D714A81556F59AFA5B7EE2DF730B328426F407C59C2E3880B4E9031

Function 07160238 Relevance: 1.7, APIs: 1, Instructions: 172COMMON

Download Yara Rule

APIs

Process32FirstW.KERNEL32(0000CD2F,0000CD2F,0000CD2F,?), ref: 07160377

Memory Dump Source

Source File: 00000000.00000002.1634890803.0000000007160000.00000040.00001000.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_uwa78qqv0x.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: 585a3dfdb8098e92bd0920033e3b1f66b1f113c70d711eb4b0b027c154088343
Instruction ID: 48b74094e1aa3f3db2764b8b0e2bb696be966670b58277f061908f1a02a459f5
Opcode Fuzzy Hash: 585a3dfdb8098e92bd0920033e3b1f66b1f113c70d711eb4b0b027c154088343
Instruction Fuzzy Hash: 9831D9EB16C120BD711A80552F5CDFA5B1EE5DF731B32852AB807D6AC2E3984F6A5031

Function 071702D7 Relevance: 1.7, APIs: 1, Instructions: 166COMMON

Download Yara Rule

APIs

Process32NextW.KERNEL32(00006C3F,00006C3F,?,?), ref: 07170472

Memory Dump Source

Source File: 00000000.00000002.1634905629.0000000007170000.00000040.00001000.00020000.00000000.sdmp, Offset: 07170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7170000_uwa78qqv0x.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: c15fb23ee6dc1e6f5dfd68a4dcd93a0459f4a227db18eb6e7dc6d76455f8b54c
Instruction ID: 01334b944421a0b7895a81a153225a42cf13237b2aa60f29383f40efcc3ec3ec
Opcode Fuzzy Hash: c15fb23ee6dc1e6f5dfd68a4dcd93a0459f4a227db18eb6e7dc6d76455f8b54c
Instruction Fuzzy Hash: 33318FFB16D320BD710A81556F59AFA5A7EE2DB730B32852AF407D59C2E3C80A4D9131

Function 07160258 Relevance: 1.7, APIs: 1, Instructions: 164COMMON

Download Yara Rule

APIs

Process32FirstW.KERNEL32(0000CD2F,0000CD2F,0000CD2F,?), ref: 07160377

Memory Dump Source

Source File: 00000000.00000002.1634890803.0000000007160000.00000040.00001000.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_uwa78qqv0x.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: e680445a574c72ec700eb4b62e39ce52ef20b1595ee7aa3b9e81b8f93a35245c
Instruction ID: 2bcae2f1166fb2024c7cbb727a78a44f6a45c38a23c1fc2f2415dc7f6cc53a74
Opcode Fuzzy Hash: e680445a574c72ec700eb4b62e39ce52ef20b1595ee7aa3b9e81b8f93a35245c
Instruction Fuzzy Hash: 1831FBF716C120BD711B80952B5CEFA571EE6DF771B32852AF807D6AC6D3980BAA4031

Function 0716029F Relevance: 1.7, APIs: 1, Instructions: 156COMMON

Download Yara Rule

APIs

Process32FirstW.KERNEL32(0000CD2F,0000CD2F,0000CD2F,?), ref: 07160377

Memory Dump Source

Source File: 00000000.00000002.1634890803.0000000007160000.00000040.00001000.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_uwa78qqv0x.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: 7970a2c7591b675d3d67f1a9737b8f8dc95e731d6fecdbf30c7102fe376c51dd
Instruction ID: 9155df5edc4c8212212f1c4f6918075f5c86319b253f86eaf183120a069d6a06
Opcode Fuzzy Hash: 7970a2c7591b675d3d67f1a9737b8f8dc95e731d6fecdbf30c7102fe376c51dd
Instruction Fuzzy Hash: 3D3138FB16C120BD721A80651B5CDFA575EF6DF331B32852AB407C6AC2D3884BBA5031

Function 07160281 Relevance: 1.7, APIs: 1, Instructions: 152COMMON

Download Yara Rule

APIs

Process32FirstW.KERNEL32(0000CD2F,0000CD2F,0000CD2F,?), ref: 07160377

Memory Dump Source

Source File: 00000000.00000002.1634890803.0000000007160000.00000040.00001000.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_uwa78qqv0x.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: 19fff39ca3c96c20e563b196b96f2d66450a5694676a7ee0acae89cf3fc77aa6
Instruction ID: 3275039449fa3649e5f26a87d3124a7fcb8a45f29f88449d5b29ba170f50e94d
Opcode Fuzzy Hash: 19fff39ca3c96c20e563b196b96f2d66450a5694676a7ee0acae89cf3fc77aa6
Instruction Fuzzy Hash: 6231E5E716C121BD721E80551B5CDFA576EF6DF331B32852AB407D6AC2E3884BAA5031

Function 071602F1 Relevance: 1.6, APIs: 1, Instructions: 131COMMON

Download Yara Rule

APIs

Process32FirstW.KERNEL32(0000CD2F,0000CD2F,0000CD2F,?), ref: 07160377

Memory Dump Source

Source File: 00000000.00000002.1634890803.0000000007160000.00000040.00001000.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_uwa78qqv0x.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: 9d679c994e8b93a37bd5feb08e9124074d44aa98c3ae8fbc9a15084814d406ef
Instruction ID: 440633ab076b879a43df0a373d1025c67d25d768a9b2ed3a996b5a5fd10eadff
Opcode Fuzzy Hash: 9d679c994e8b93a37bd5feb08e9124074d44aa98c3ae8fbc9a15084814d406ef
Instruction Fuzzy Hash: A421D4EB16C120BD712A80652F5CDF7171EE1DF731B328926B807D6AC6E3884FAA4031

Function 07170328 Relevance: 1.6, APIs: 1, Instructions: 129COMMON

Download Yara Rule

APIs

Process32NextW.KERNEL32(00006C3F,00006C3F,?,?), ref: 07170472

Memory Dump Source

Source File: 00000000.00000002.1634905629.0000000007170000.00000040.00001000.00020000.00000000.sdmp, Offset: 07170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7170000_uwa78qqv0x.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 3348700692806f00119d694d051c2799a99704e275319d281b6734a426cfc53e
Instruction ID: 94962436dd5bd3859b60d5aeb613a6fe7832ccc14de689d078d1d4fed3ea7298
Opcode Fuzzy Hash: 3348700692806f00119d694d051c2799a99704e275319d281b6734a426cfc53e
Instruction Fuzzy Hash: 3B21D1EB1AC310BDA00A81495F59AFA5A3EF3DF330E328526B007C59C2E3D80B499570

Function 07160300 Relevance: 1.6, APIs: 1, Instructions: 127COMMON

Download Yara Rule

APIs

Process32FirstW.KERNEL32(0000CD2F,0000CD2F,0000CD2F,?), ref: 07160377

Memory Dump Source

Source File: 00000000.00000002.1634890803.0000000007160000.00000040.00001000.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_uwa78qqv0x.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: 46618c8f4cb68d39ec524dbec7fed11c6ae9e35c8635d9e22cbe082978d81222
Instruction ID: a84dcfd7734c8967caced51f9b66d2e16e310787f3d32337a67cc13faf5d2d49
Opcode Fuzzy Hash: 46618c8f4cb68d39ec524dbec7fed11c6ae9e35c8635d9e22cbe082978d81222
Instruction Fuzzy Hash: 5121C2EB16C120BD712A81A52B5CDF65B1EE1DF7717328526B807D6AC6E3884FAA4031

Function 0716036F Relevance: 1.6, APIs: 1, Instructions: 124COMMON

Download Yara Rule

APIs

Process32FirstW.KERNEL32(0000CD2F,0000CD2F,0000CD2F,?), ref: 07160377

Memory Dump Source

Source File: 00000000.00000002.1634890803.0000000007160000.00000040.00001000.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_uwa78qqv0x.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: 9c60131a3d21d2d350ba88e65c2373bc7336f1bf16631aedba6c95bdf2ac944c
Instruction ID: 5d316536546f49d449b720906fe84c054fd598d12263ec68b8ce7b99e789e89c
Opcode Fuzzy Hash: 9c60131a3d21d2d350ba88e65c2373bc7336f1bf16631aedba6c95bdf2ac944c
Instruction Fuzzy Hash: 0621C3EB16C220BD716E81652B5CDF65B1EE1DB3317328526F807D5AC6E3880FAA4031

Function 0716032D Relevance: 1.6, APIs: 1, Instructions: 122COMMON

Download Yara Rule

APIs

Process32FirstW.KERNEL32(0000CD2F,0000CD2F,0000CD2F,?), ref: 07160377

Memory Dump Source

Source File: 00000000.00000002.1634890803.0000000007160000.00000040.00001000.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_uwa78qqv0x.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: 85c451b75342496699b5835ff2298b2487dda5e6d3fe13c3811bdabb57d0cd11
Instruction ID: ee1c94683557297a34b1cd852bf07f772aa618debc764b3728571b0e4be95a22
Opcode Fuzzy Hash: 85c451b75342496699b5835ff2298b2487dda5e6d3fe13c3811bdabb57d0cd11
Instruction Fuzzy Hash: 8421C6EB16C1107DB16A81652F5CEF65B1EE1DB3317328526F407D5AC6D3880FAE4031

Function 07170345 Relevance: 1.6, APIs: 1, Instructions: 122COMMON

Download Yara Rule

APIs

Process32NextW.KERNEL32(00006C3F,00006C3F,?,?), ref: 07170472

Memory Dump Source

Source File: 00000000.00000002.1634905629.0000000007170000.00000040.00001000.00020000.00000000.sdmp, Offset: 07170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7170000_uwa78qqv0x.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 9f50f9ed09bd4928a0e2063a2f1a69d9cbeb2e6fad0e108775986e9a0b9346c6
Instruction ID: 6b1e0f650fbbdf37d6726c089cb177a3d13e46ccdf3e6fe859e3c3ef74d088f2
Opcode Fuzzy Hash: 9f50f9ed09bd4928a0e2063a2f1a69d9cbeb2e6fad0e108775986e9a0b9346c6
Instruction Fuzzy Hash: 7E21BEEB0AC320BD614A81995F59AFA5A3EF3DF330E328526B407D59C2E7D80A4DD431

Function 0717035E Relevance: 1.6, APIs: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Process32NextW.KERNEL32(00006C3F,00006C3F,?,?), ref: 07170472

Memory Dump Source

Source File: 00000000.00000002.1634905629.0000000007170000.00000040.00001000.00020000.00000000.sdmp, Offset: 07170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7170000_uwa78qqv0x.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 8f4a0070ffca67a458a6284e5e836a0a6d97bb6560a29b62f97d1fc8ec793d8e
Instruction ID: f49bf002273680c2b809de46f5483bc2742a5e843e9f0908457c4beebb76b7f3
Opcode Fuzzy Hash: 8f4a0070ffca67a458a6284e5e836a0a6d97bb6560a29b62f97d1fc8ec793d8e
Instruction Fuzzy Hash: 0F21BEFB1AC320BD614A41595B5AAFA5A7EE2DF230B328526B407D59C3E3C80A899071

Function 071703CA Relevance: 1.6, APIs: 1, Instructions: 120COMMON

Download Yara Rule

APIs

Process32NextW.KERNEL32(00006C3F,00006C3F,?,?), ref: 07170472

Memory Dump Source

Source File: 00000000.00000002.1634905629.0000000007170000.00000040.00001000.00020000.00000000.sdmp, Offset: 07170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7170000_uwa78qqv0x.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 37d7edd6c579c2d73c1d08a26108ff8b940e511e419e267ce2286cbdba495f1d
Instruction ID: 42ccf9228d255279dd97b6382edb2a6cce5a63cded07bbce843e706fdc309cb2
Opcode Fuzzy Hash: 37d7edd6c579c2d73c1d08a26108ff8b940e511e419e267ce2286cbdba495f1d
Instruction Fuzzy Hash: 1521AEEB0AD310BDA04A41595F59AF65A7EF3DF730A328526B407D5AC2E3D80A8DD031

Function 07160357 Relevance: 1.6, APIs: 1, Instructions: 112COMMON

Download Yara Rule

APIs

Process32FirstW.KERNEL32(0000CD2F,0000CD2F,0000CD2F,?), ref: 07160377

Memory Dump Source

Source File: 00000000.00000002.1634890803.0000000007160000.00000040.00001000.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_uwa78qqv0x.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: b15bff9b4feea29eaca29940ebfc28ee016de26ba67e01030241c24255c462cf
Instruction ID: 51d342db064b75de5d2b3220efe8758b1fae7132f50efb874beab785eea5b124
Opcode Fuzzy Hash: b15bff9b4feea29eaca29940ebfc28ee016de26ba67e01030241c24255c462cf
Instruction Fuzzy Hash: 5811D3E716C110BDB12A80662F5CEF71B5EE2DB3317328926F407D5AC6D3880BAA4071

Function 07170393 Relevance: 1.6, APIs: 1, Instructions: 111COMMON

Download Yara Rule

APIs

Process32NextW.KERNEL32(00006C3F,00006C3F,?,?), ref: 07170472

Memory Dump Source

Source File: 00000000.00000002.1634905629.0000000007170000.00000040.00001000.00020000.00000000.sdmp, Offset: 07170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7170000_uwa78qqv0x.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: e65e7e3687f749a299d85404bc03b3ebed15e74f1d4252a3cfc40eb46813bec6
Instruction ID: 460741f5cc17e56b4f45a5bd9bb00d5f309d5f5808232b3e22f92b7f862b6371
Opcode Fuzzy Hash: e65e7e3687f749a299d85404bc03b3ebed15e74f1d4252a3cfc40eb46813bec6
Instruction Fuzzy Hash: 5011D2E60AD310ADA14A41595F5A5F66B7EB6DF230B328127F007D9AC3E7C80B49C171

Function 071703F2 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

Process32NextW.KERNEL32(00006C3F,00006C3F,?,?), ref: 07170472

Memory Dump Source

Source File: 00000000.00000002.1634905629.0000000007170000.00000040.00001000.00020000.00000000.sdmp, Offset: 07170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7170000_uwa78qqv0x.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 0d3feebe32a38f967afada93467309a73a3d3c7cd8a417c0372528884e457783
Instruction ID: 1414b1e1211c9f284aff13fb8973fca9a0f8de180211d50bd94013748903fab5
Opcode Fuzzy Hash: 0d3feebe32a38f967afada93467309a73a3d3c7cd8a417c0372528884e457783
Instruction Fuzzy Hash: 491125EB0AD310BC600E51599F596F61A3FE2DF230A328227B003949C3A7C80A4DC430

Function 071703BA Relevance: 1.6, APIs: 1, Instructions: 90COMMON

Download Yara Rule

APIs

Process32NextW.KERNEL32(00006C3F,00006C3F,?,?), ref: 07170472

Memory Dump Source

Source File: 00000000.00000002.1634905629.0000000007170000.00000040.00001000.00020000.00000000.sdmp, Offset: 07170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7170000_uwa78qqv0x.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 4f13e163fa7a78d3b6e719e12778256bb583bbc882ac03b51f4514305f980c68
Instruction ID: 212a5491ab460a4c549795c2bf4de7459955683ac2df1dc4f7d9b5d321e85f87
Opcode Fuzzy Hash: 4f13e163fa7a78d3b6e719e12778256bb583bbc882ac03b51f4514305f980c68
Instruction Fuzzy Hash: DC1104FB0AD310BC604A81599F5A6F65A3FE2DF230A329626F003959C3E7C80A8DC431

Function 071703E4 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

Process32NextW.KERNEL32(00006C3F,00006C3F,?,?), ref: 07170472

Memory Dump Source

Source File: 00000000.00000002.1634905629.0000000007170000.00000040.00001000.00020000.00000000.sdmp, Offset: 07170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7170000_uwa78qqv0x.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: afc3902cce33d911ee7b7a1bf43003b03035e14244fcfe8cf643f4a552e90491
Instruction ID: c1e80dbd15ed1a31fa63ee0f69557d226782bb8caa300bca353b5523b117574a
Opcode Fuzzy Hash: afc3902cce33d911ee7b7a1bf43003b03035e14244fcfe8cf643f4a552e90491
Instruction Fuzzy Hash: 8D01F2FB1AD310BC605A91699F1A6F65A7FA2DF230E328126B003959C3E7D80A8DC031

Function 07170413 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Process32NextW.KERNEL32(00006C3F,00006C3F,?,?), ref: 07170472

Memory Dump Source

Source File: 00000000.00000002.1634905629.0000000007170000.00000040.00001000.00020000.00000000.sdmp, Offset: 07170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7170000_uwa78qqv0x.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 200d05fd0be617aa36e11dd4252080a7cdbfeceb4bd0fcc4e5300e38d99fa71f
Instruction ID: fffc522926256021ed65cba45e4be4a0b193fa488362ed83cf16fd1ce7cc8ca2
Opcode Fuzzy Hash: 200d05fd0be617aa36e11dd4252080a7cdbfeceb4bd0fcc4e5300e38d99fa71f
Instruction Fuzzy Hash: D50168F206C3109ED30A9A398B562F93B72BBDB230F328136E003C69C3D398065DC521

Function 0717045C Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

Process32NextW.KERNEL32(00006C3F,00006C3F,?,?), ref: 07170472

Memory Dump Source

Source File: 00000000.00000002.1634905629.0000000007170000.00000040.00001000.00020000.00000000.sdmp, Offset: 07170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7170000_uwa78qqv0x.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: f211665dc0eb6f357414220d014a06dc5a1482f7473b12df9f44913ff1fad95a
Instruction ID: fe02a3459030b8a90ed10b3ce94cb0a18845523d7b5493bf128c47321822e786
Opcode Fuzzy Hash: f211665dc0eb6f357414220d014a06dc5a1482f7473b12df9f44913ff1fad95a
Instruction Fuzzy Hash: F1E0ABF3028710AC010A453E0F532F71A7AA4DF230A72C316E00746DC283584B58C951

Function 0717044E Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

Process32NextW.KERNEL32(00006C3F,00006C3F,?,?), ref: 07170472

Memory Dump Source

Source File: 00000000.00000002.1634905629.0000000007170000.00000040.00001000.00020000.00000000.sdmp, Offset: 07170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7170000_uwa78qqv0x.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: ec667d848e16f4ee7b34c4af5b1e57da53f063fb9a98ad2ef979ad8cfdf7ca98
Instruction ID: 09128b06727e0e7df47a959f26b8edd208f9ca399bd3843018332dba7f345bf3
Opcode Fuzzy Hash: ec667d848e16f4ee7b34c4af5b1e57da53f063fb9a98ad2ef979ad8cfdf7ca98
Instruction Fuzzy Hash: FBE02BF2069710AD110A55394F961FA1675B9DF230E32C219E003509C2C7544A98C551

Function 07170465 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

Process32NextW.KERNEL32(00006C3F,00006C3F,?,?), ref: 07170472

Memory Dump Source

Source File: 00000000.00000002.1634905629.0000000007170000.00000040.00001000.00020000.00000000.sdmp, Offset: 07170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7170000_uwa78qqv0x.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 4ab7adc457d8c01c511a29b3c82d8eae01e4ab73b7f133e417f506b75b335fc0
Instruction ID: 2a727e435feb106f16e7933d230eb86bb3a306779db6ca43e993c9301fb04a42
Opcode Fuzzy Hash: 4ab7adc457d8c01c511a29b3c82d8eae01e4ab73b7f133e417f506b75b335fc0
Instruction Fuzzy Hash: F6E02BE2038710BC500F4A3D4F561F65635A5DF230635C716A00380DC3C7585654CA61

Function 07100A51 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634796721.0000000007100000.00000040.00001000.00020000.00000000.sdmp, Offset: 07100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7100000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a47d3878d193d4487e4c5380d4ddca43a70f0ec4b0a3e839138e7cdb4e19d04
Instruction ID: ae3716e0c3d9c20fd7a051415e285fd85416127e5e1836ff8315b7513ffcd0d9
Opcode Fuzzy Hash: 0a47d3878d193d4487e4c5380d4ddca43a70f0ec4b0a3e839138e7cdb4e19d04
Instruction Fuzzy Hash: ED2147FB56C114FEA109C9815740BFA7769DADF630B32846AF407932C2E3E00B5946F1

Function 07100AD7 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634796721.0000000007100000.00000040.00001000.00020000.00000000.sdmp, Offset: 07100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7100000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7a63bf62267165afb0602f1f155ef57c160e369c76ab35cc57ff0c95212ac83
Instruction ID: 9aaf6d3ad856e014c52ee152f60282d37bad71ae9745fb196e382ec3261fe5b7
Opcode Fuzzy Hash: c7a63bf62267165afb0602f1f155ef57c160e369c76ab35cc57ff0c95212ac83
Instruction Fuzzy Hash: FE2104FB56C205EDA50AC5815700BFA7369DBCF630F328466E40B971C2D3D10B5542F1

Function 07100A6E Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634796721.0000000007100000.00000040.00001000.00020000.00000000.sdmp, Offset: 07100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7100000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba4365fa7f294fbe3099b94b976b0708565a388c8f21ef20375005a6ec2b7d97
Instruction ID: 4ff1d7bba4b9b66a818422b7b967566675b1ca8566aafa11b5eb5ec4636ae5c0
Opcode Fuzzy Hash: ba4365fa7f294fbe3099b94b976b0708565a388c8f21ef20375005a6ec2b7d97
Instruction Fuzzy Hash: DC21E4FA52C208EEA10AD5815750BFA63699BDF230F32846AE80BA71C2D3D10B5442B1

Function 07100A86 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634796721.0000000007100000.00000040.00001000.00020000.00000000.sdmp, Offset: 07100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7100000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e85b6c6905e33bd62a7368f7c263ce303265487b1bdb54b31cded5e6dd190402
Instruction ID: 9332cca03a88bc1f784c90985aadfe56ccd44b2112b35fe91d5885ab92bac12f
Opcode Fuzzy Hash: e85b6c6905e33bd62a7368f7c263ce303265487b1bdb54b31cded5e6dd190402
Instruction Fuzzy Hash: 8A21D6FB56D104FDA505C9819750BFA7769DACF234B32446AF407961C2D3E00B5456B1

Function 07100AA2 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634796721.0000000007100000.00000040.00001000.00020000.00000000.sdmp, Offset: 07100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7100000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae4d4a89c2c9c19e7f38f025ae94f530efdabdc9c90ea836253bef26375542b6
Instruction ID: 7bd2c9a830b489ed2bce846303858ee39ef3e651b6772dd99dbc963b865247fe
Opcode Fuzzy Hash: ae4d4a89c2c9c19e7f38f025ae94f530efdabdc9c90ea836253bef26375542b6
Instruction Fuzzy Hash: FB2124FB02C218FDA10AC9805B50BFA7769DACF230F32446AF807961C2D3D10B4842B1

Function 07100AF9 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634796721.0000000007100000.00000040.00001000.00020000.00000000.sdmp, Offset: 07100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7100000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2929da961523541c2e2defd1a9458db86664ded571db2b880b9081e6921f2c9c
Instruction ID: 50dbfb0dc9bfd6efaf7008e2a18ec7e1c65e7f06289de6e2844e22b5b8f78faf
Opcode Fuzzy Hash: 2929da961523541c2e2defd1a9458db86664ded571db2b880b9081e6921f2c9c
Instruction Fuzzy Hash: A42122FB16D214EDA609D8815750BFA7769DACF230B32846BE40B921C2E3E14B4846F1

Function 07100AB1 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634796721.0000000007100000.00000040.00001000.00020000.00000000.sdmp, Offset: 07100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7100000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b6f0ff07fbc23a7896e17b30b51dea90bca6213d9c9d3220de7d5a892e3a26e
Instruction ID: d0785f2e86766df7c94099d869dfb7042af07ca892fb0a3041c2cfba090c73da
Opcode Fuzzy Hash: 2b6f0ff07fbc23a7896e17b30b51dea90bca6213d9c9d3220de7d5a892e3a26e
Instruction Fuzzy Hash: AC21D1FB56C219FDA50AD9815750BFA7369DACF230F328466F807972C2D3E10B4946B1

Function 07100AC3 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634796721.0000000007100000.00000040.00001000.00020000.00000000.sdmp, Offset: 07100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7100000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f94e25b38b1f0fcb1058dcf7c2055016a9348601040999edd63c5280b480d90e
Instruction ID: e7d54833617b098059f13f6a2138ebad625e38ba55f2ac5c0df1be42862b9513
Opcode Fuzzy Hash: f94e25b38b1f0fcb1058dcf7c2055016a9348601040999edd63c5280b480d90e
Instruction Fuzzy Hash: 9521FFFB52C208EDA209D9815750BFA6769DACF230B32886AE407921C2E3E14B4946B1

Function 07100AE8 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634796721.0000000007100000.00000040.00001000.00020000.00000000.sdmp, Offset: 07100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7100000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f7800909b52628137f4f24ae24e64a55a7fb75bc35142708bd39174b7a829cd
Instruction ID: 11249af07c0154179e7f24cd916637a13a035a7b1db69568badf08c6ddab51fd
Opcode Fuzzy Hash: 3f7800909b52628137f4f24ae24e64a55a7fb75bc35142708bd39174b7a829cd
Instruction Fuzzy Hash: 0811E4FB12C218FDA106D9815750BFB6769DADF231F328466F407A21C1D3E10B4946B1

Function 071A0E3F Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634955927.00000000071A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71a0000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d861bbb2c4e06b9c7d28b430151aa199bc852e50a0d221d78d9648ff07394ac0
Instruction ID: 2bab16a63bee41875ccfeb9c88febc0e549eba47dfff1285bb2fc58898dfabed
Opcode Fuzzy Hash: d861bbb2c4e06b9c7d28b430151aa199bc852e50a0d221d78d9648ff07394ac0
Instruction Fuzzy Hash: CD1134EF2582157DE90695546A44BF72A2ED7DBB30F318426F442E50C2B3D04E4A3071

Function 07100B3C Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634796721.0000000007100000.00000040.00001000.00020000.00000000.sdmp, Offset: 07100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7100000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: febc6cc2628584f95fe593ae08eb5f3c63eb562f519ec4696e9d55eae65711f7
Instruction ID: 054cd35585aa959a4885347644a2f9325d19fce91ffee32703a69b68e7709823
Opcode Fuzzy Hash: febc6cc2628584f95fe593ae08eb5f3c63eb562f519ec4696e9d55eae65711f7
Instruction Fuzzy Hash: 191104FA52C215EEA21AD99147407FB7369EBCF235F32846AE407921C2E3E10B4946F1

Function 071A0E2E Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634955927.00000000071A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71a0000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adbfc5c97d7fbf66a0b0c6c92a33e63b880ce90c16c25971ad1e5c975dd3332a
Instruction ID: 2ad7583b26c95d6aecf2de1919d3f955ed081dd1803227728a7c9d8838c7abf1
Opcode Fuzzy Hash: adbfc5c97d7fbf66a0b0c6c92a33e63b880ce90c16c25971ad1e5c975dd3332a
Instruction Fuzzy Hash: 17019EDF2582087CE50A51546F44BF76A2ED3DB730E328426F906E55C6B2E50E893031

Function 07100B26 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634796721.0000000007100000.00000040.00001000.00020000.00000000.sdmp, Offset: 07100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7100000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4344b3dc17c339f454c62a2f64d09934f083f74a3321ac00f9453b50513b5aa7
Instruction ID: 4dd963db0eb76e88c47b6fd649738efcb5d599f60b82ec5222e4abf9b6c05e25
Opcode Fuzzy Hash: 4344b3dc17c339f454c62a2f64d09934f083f74a3321ac00f9453b50513b5aa7
Instruction Fuzzy Hash: 741125FA52C214EDA20AD9915750BFA7768DACF235F32846AF40BA31C2D3E10B4956F1

Function 071A0E28 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634955927.00000000071A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71a0000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21b7842405b08c414193d713fc7d493e73cd66145bd99ad2194a8bc9a12914e5
Instruction ID: c290812afa3fa6778ac234fda7e17f8459a7de7225672445adcf2aa7aa4be3d9
Opcode Fuzzy Hash: 21b7842405b08c414193d713fc7d493e73cd66145bd99ad2194a8bc9a12914e5
Instruction Fuzzy Hash: 6901BCDF258218BDF50A51442B48BFB6A2ED3DB730E328026F907E56C2B3D50E893032

Function 07100B53 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634796721.0000000007100000.00000040.00001000.00020000.00000000.sdmp, Offset: 07100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7100000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a925d8e0426f270db95d18c70de15d1547462b2074439f77b2458f05d509d098
Instruction ID: d0d314288cbbf5b62243e04dbc2d08534e8c32f1fb7d7526497889f2faa026c8
Opcode Fuzzy Hash: a925d8e0426f270db95d18c70de15d1547462b2074439f77b2458f05d509d098
Instruction Fuzzy Hash: 8E1125FB42C218ADA60699920750BFA6778DACF334B3244ABE407931C2D3E50F8946B1

Function 07100C01 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634796721.0000000007100000.00000040.00001000.00020000.00000000.sdmp, Offset: 07100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7100000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f94e4db69f86f2e3258af9e09cd1c1cf83b4fc89d24e0ad1f35f76e3db30bc4
Instruction ID: 4531b97f6753e9eca33484531ce5acb00ac1a624212916517ba16f140dad046f
Opcode Fuzzy Hash: 1f94e4db69f86f2e3258af9e09cd1c1cf83b4fc89d24e0ad1f35f76e3db30bc4
Instruction Fuzzy Hash: 16118CF701D6049DE602DAE117007FA7B70DECB23173008ABE452970C2C3D1069997B2

Function 071A0E64 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634955927.00000000071A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71a0000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b2aceda614cafb1c18b1a56cb5335e00ba9518a448988522afb8aaa8d3e4d46
Instruction ID: 13c0fe7a8e48de8391ee97e4c0505c884b93e22199912031cee2d32aac743a64
Opcode Fuzzy Hash: 2b2aceda614cafb1c18b1a56cb5335e00ba9518a448988522afb8aaa8d3e4d46
Instruction Fuzzy Hash: 240145EB20C219BEE70A95645A84AFB7F2AD7C7330B31806AF80295887E3950E596031

Function 071A0E8C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634955927.00000000071A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71a0000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd7e7b194229d969f38dc0efdaeb6159bdd03501cc0c4d59d765798d0ccd23a8
Instruction ID: 2c65feb4a4bc4bee98b69289b0ad62a54af8f62e8b03f90b92923185080dd690
Opcode Fuzzy Hash: dd7e7b194229d969f38dc0efdaeb6159bdd03501cc0c4d59d765798d0ccd23a8
Instruction Fuzzy Hash: 0501FCEF5142167DE61661641A84AFB6A6FD7CB330F31C435F802D1586F3954E453031

Function 07100B67 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634796721.0000000007100000.00000040.00001000.00020000.00000000.sdmp, Offset: 07100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7100000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ca0218ea44749b378c4f4aa7921d234e3a618d5db9f42260b9f31385197b162
Instruction ID: 0628e6ed014f7425efb9218caf3e874a87316fa9a1432e7b932623132232df1f
Opcode Fuzzy Hash: 4ca0218ea44749b378c4f4aa7921d234e3a618d5db9f42260b9f31385197b162
Instruction Fuzzy Hash: 7B0126FB12C214ACA506DD811740BFA6364DADF234B31846BE403921C2D3E10B4456B1

Function 07100B79 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634796721.0000000007100000.00000040.00001000.00020000.00000000.sdmp, Offset: 07100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7100000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9951a029dbd9bb229062553d9a6c50ad465c120ddf71f89bbe826c7e26b82189
Instruction ID: c8ad871007e54c5793f7829056174123a10bb254d9e173d233014b9b17a6a6a2
Opcode Fuzzy Hash: 9951a029dbd9bb229062553d9a6c50ad465c120ddf71f89bbe826c7e26b82189
Instruction Fuzzy Hash: F901F5FB42C215ADA605D9925700BFA7764DBCF231B31447BE403932C1D3E10B8856B2

Function 07100BA0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634796721.0000000007100000.00000040.00001000.00020000.00000000.sdmp, Offset: 07100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7100000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3fec980a4d1ed94e0626a1905ad31e61690fc629f9911465800752c76d64f9c
Instruction ID: e3deb14f4cd20eb1a8d9f793a3c9fe9edd1c9e6fdbc2a6e9459b142d6a58070b
Opcode Fuzzy Hash: f3fec980a4d1ed94e0626a1905ad31e61690fc629f9911465800752c76d64f9c
Instruction Fuzzy Hash: F101F7FB52C219ACA642D9D15B00BFE7765DACF270B31487BF802930C1C3D50A4956B1

Function 07100BB3 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634796721.0000000007100000.00000040.00001000.00020000.00000000.sdmp, Offset: 07100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7100000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de8affeae4497f2d0f3e27eb432bd6c3178696fcfc4d49940d026e0587f8fceb
Instruction ID: 87c44ea36951b20eb61c3e6c625da8093bd49fd0e8b8d9b04be95a7601e7ffaa
Opcode Fuzzy Hash: de8affeae4497f2d0f3e27eb432bd6c3178696fcfc4d49940d026e0587f8fceb
Instruction Fuzzy Hash: A901F2FB52C614ADA601D99157407FE73B4DBCB335B3148AAF443930C1D3E50A5996B2

Function 071A0EA9 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634955927.00000000071A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71a0000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 986ff35c54b8177960fff4b182399fd10eac3a78171008a3b9ecc9a740c2e9d2
Instruction ID: 6c2446c1382e99bff911841648c7dc92822129d3d66c14073c79545e10fe2630
Opcode Fuzzy Hash: 986ff35c54b8177960fff4b182399fd10eac3a78171008a3b9ecc9a740c2e9d2
Instruction Fuzzy Hash: 0EF0BEEB1081197D7A0A55556B449FB2A2FD7CB730732C52AF806E5586A7A10F4A2031

Function 071A0EAE Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634955927.00000000071A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71a0000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20412fc0a44f183c457ec0678b20472e166dcad7d1ec8a868a568b4cdfe579d0
Instruction ID: f2389b651de74292e01a8634a81f8b0c3ca722739d21292f21d285cf71163784
Opcode Fuzzy Hash: 20412fc0a44f183c457ec0678b20472e166dcad7d1ec8a868a568b4cdfe579d0
Instruction Fuzzy Hash: AAF0E2EB2181157DBA0A5A646B449FB2B3FD7CB330731C926F806D0946E7A20F5A2031

Function 071A0EC3 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634955927.00000000071A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71a0000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f52d24d2224fd5bc5c5c2f8c645cdfdf3e72fdc1cffdd496d25456c70cce598d
Instruction ID: 00c3c1745251cf46b91a1ddd0941d705320a7ad6fb12613fa8e0b1920f4d24f3
Opcode Fuzzy Hash: f52d24d2224fd5bc5c5c2f8c645cdfdf3e72fdc1cffdd496d25456c70cce598d
Instruction Fuzzy Hash: 54F027EB1083057EA60A965067849FB3F3ADBC7330731842AF40292642F7E00B592031

Function 071A0F57 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634955927.00000000071A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71a0000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d3881f89265bcec1de66994ad9bb1537ef5b242fb2770ba1fefc0d09409560a
Instruction ID: 3968c158d0fa8d45cc8f58084cefcdcf9fb3e29c116bf7a60b85e3761f89ff9d
Opcode Fuzzy Hash: 7d3881f89265bcec1de66994ad9bb1537ef5b242fb2770ba1fefc0d09409560a
Instruction Fuzzy Hash: 2DE068C724D2672B8F1B625429E00E33F77AB5F620335B496E0C2C5687E79159879051

Function 071A0EE7 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634955927.00000000071A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71a0000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f7fede7f72b5d8e2e23356e6e679c55551139545e7063967803494b8e9ab542
Instruction ID: 73ac80c7dd268ca3ccdca660ed568006db3e815058528836acf11a544b1e3b5a
Opcode Fuzzy Hash: 3f7fede7f72b5d8e2e23356e6e679c55551139545e7063967803494b8e9ab542
Instruction Fuzzy Hash: F7E020EF1043163D9B4721E856856FF7D2B9B8F230B714536F90256587F3D14F451061

Function 071A0F0A Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634955927.00000000071A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71a0000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9a938ea93829dcb59071832995341aa9234dcbd387e6dd789f3d5d09954e9c0
Instruction ID: a902f437b3e6fedab06c5c23f324903e433ea7f111eaa70871e766b5e6f3f693
Opcode Fuzzy Hash: d9a938ea93829dcb59071832995341aa9234dcbd387e6dd789f3d5d09954e9c0
Instruction Fuzzy Hash: 43E026CB0083423BCB4316A00AD82F63F3B5B5B230720009BF48159283FAD64B466253

Function 071A0F1C Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634955927.00000000071A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71a0000_uwa78qqv0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03ec400230b65d8aa56ff0d166ac0ac30d07da53d0d11ed378d9f2d1491042e7
Instruction ID: d6d9ad3d6c19b8becd30a7b07653df3b3f240753337bd3a807b325a85a37625a
Opcode Fuzzy Hash: 03ec400230b65d8aa56ff0d166ac0ac30d07da53d0d11ed378d9f2d1491042e7
Instruction Fuzzy Hash: 6FD012DB1001063A8A1626945A855EB7B3B5B876303705464F41659346E7E24B4635A2

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report uwa78qqv0x.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_uwa78qqv0x.exe_48a44e25356dcac01dc63e486932e2a2d4eecb3c_7c1cd271_5544698b-a6f2-4784-a8f8-d05a9453646b\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2A54.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2B3F.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2B6F.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
uwa78qqv0x.exe

Function 07170136 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 332
COMMON

Function 07170170 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 302
COMMON

Function 07110C90 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 266
COMMON

Function 07110C88 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 243
COMMON

Function 07110CC6 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 232
COMMON

Function 07110D19 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 195
COMMON

Function 07110D05 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 189
COMMON

Function 07110D5D Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 165
COMMON

Function 0717003B Relevance: 1.9, APIs: 1, Instructions: 366
COMMON

Function 07170034 Relevance: 1.8, APIs: 1, Instructions: 343
COMMON

Function 07170046 Relevance: 1.8, APIs: 1, Instructions: 341
COMMON

Function 07170078 Relevance: 1.8, APIs: 1, Instructions: 334
COMMON

Function 07170060 Relevance: 1.8, APIs: 1, Instructions: 333
COMMON

Function 071700A5 Relevance: 1.8, APIs: 1, Instructions: 316
COMMON

Function 071700B8 Relevance: 1.8, APIs: 1, Instructions: 305
COMMON