Edit tour

Windows Analysis Report
random.exe

Overview

General Information

Sample name:random.exe
Analysis ID:1675412
MD5:c09bbe60622793d6268a68cd215d28d2
SHA1:0a8c61f3bf061e0b9e4ec9d59df67d75910e9bd5
SHA256:644635088b2922ed3fced650a1d88e140b2bc8b3553c8bc741c0f55a94c7476e
Tags:exeuser-abuse_ch
Infos:

Detection

CryptOne
Score:100
Range:0 - 100
Confidence:100%

Signatures

Detected unpacking (changes PE section rights)
Multi AV Scanner detection for submitted file
Yara detected CryptOne packer
Allocates memory in foreign processes
Hides threads from debuggers
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
PE file contains section with special chars
Potentially malicious time measurement code found
Sample uses process hollowing technique
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Writes to foreign memory regions
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Entry point lies outside standard sections
HTTP GET or POST without a user agent
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara detected Keylogger Generic

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
  • System is w10x64
  • random.exe (PID: 7704 cmdline: "C:\Users\user\Desktop\random.exe" MD5: C09BBE60622793D6268A68CD215D28D2)
    • svchost015.exe (PID: 6488 cmdline: "C:\Users\user\Desktop\random.exe" MD5: B826DD92D78EA2526E465A34324EBEEA)
  • cleanup
No configs have been found
SourceRuleDescriptionAuthorStrings
C:\Users\user\AppData\Local\Temp\svchost015.exeJoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
    C:\Users\user\AppData\Local\Temp\svchost015.exeJoeSecurity_DelphiSystemParamCountDetected Delphi use of System.ParamCount()Joe Security
      SourceRuleDescriptionAuthorStrings
      00000003.00000000.1599518700.0000000000401000.00000020.00000001.01000000.00000006.sdmpJoeSecurity_DelphiSystemParamCountDetected Delphi use of System.ParamCount()Joe Security
        00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmpJoeSecurity_CryptYara detected CryptOne packerJoe Security
          00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmpJoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
            00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmpJoeSecurity_DelphiSystemParamCountDetected Delphi use of System.ParamCount()Joe Security
              Process Memory Space: random.exe PID: 7704JoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
                Click to see the 1 entries
                SourceRuleDescriptionAuthorStrings
                3.0.svchost015.exe.400000.0.unpackJoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
                  3.0.svchost015.exe.400000.0.unpackJoeSecurity_DelphiSystemParamCountDetected Delphi use of System.ParamCount()Joe Security
                    No Sigma rule has matched
                    No Suricata rule has matched

                    Click to jump to signature section

                    Show All Signature Results

                    AV Detection

                    barindex
                    Source: random.exeVirustotal: Detection: 27%Perma Link
                    Source: random.exeReversingLabs: Detection: 44%
                    Source: Submited SampleNeural Call Log Analysis: 88.3%
                    Source: random.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
                    Source: unknownHTTPS traffic detected: 142.250.68.225:443 -> 192.168.2.5:49695 version: TLS 1.2
                    Source: global trafficHTTP traffic detected: GET /download?id=1YBVIDkZgygNfUU2rbJXXCYdrzay5rMdY&export=download&authuser=0&confirm=t HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0Host: drive.usercontent.google.comConnection: Keep-AliveCache-Control: no-cache
                    Source: Joe Sandbox ViewJA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.156.72.196
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.156.72.196
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.156.72.196
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.156.72.196
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.156.72.196
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.156.72.196
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.156.72.196
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.156.72.196
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.156.72.196
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.156.72.196
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.156.72.196
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.156.72.196
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.156.72.196
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.156.72.196
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.156.72.196
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.156.72.196
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.156.72.196
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.156.72.196
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.156.72.196
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.156.72.196
                    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                    Source: global trafficHTTP traffic detected: GET /download?id=1YBVIDkZgygNfUU2rbJXXCYdrzay5rMdY&export=download&authuser=0&confirm=t HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0Host: drive.usercontent.google.comConnection: Keep-AliveCache-Control: no-cache
                    Source: global trafficDNS traffic detected: DNS query: drive.usercontent.google.com
                    Source: svchost015.exe, 00000003.00000002.2554279889.00000000006AC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.156.72.196/
                    Source: svchost015.exe, 00000003.00000002.2554975818.0000000002DA0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.156.72.196/success?substr=mixsix&s=three&sub=none
                    Source: svchost015.exe, 00000003.00000002.2554975818.0000000002DA0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.156.72.196/success?substr=mixsix&s=three&sub=none0.1
                    Source: svchost015.exe, 00000003.00000002.2554975818.0000000002DA0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.156.72.196/success?substr=mixsix&s=three&sub=none0.1S
                    Source: svchost015.exe, 00000003.00000002.2554279889.00000000006AC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.156.72.196/success?substr=mixsix&s=three&sub=noneE
                    Source: svchost015.exe, 00000003.00000002.2554279889.00000000006AC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.156.72.196/success?substr=mixsix&s=three&sub=noneRYPT32.dll.muit_
                    Source: svchost015.exe, 00000003.00000002.2554975818.0000000002DA0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.156.72.196/success?substr=mixsix&s=three&sub=nonec
                    Source: svchost015.exe, 00000003.00000002.2554279889.00000000006AC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.156.72.196/success?substr=mixsix&s=three&sub=nonek
                    Source: svchost015.exe, 00000003.00000002.2554279889.00000000006AC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.156.72.196/success?substr=mixsix&s=three&sub=nonendOIDInfo
                    Source: svchost015.exe, 00000003.00000002.2554975818.0000000002DA0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.156.72.196/success?substr=mixsix&s=three&sub=noner
                    Source: svchost015.exe, 00000003.00000002.2554279889.00000000006AC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.156.72.196/success?substr=mixsix&s=three&sub=nonertificates
                    Source: svchost015.exe, 00000003.00000002.2554279889.00000000006AC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.156.72.196/three&sub=noneemp
                    Source: svchost015.exe, 00000003.00000002.2554279889.00000000006AC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.156.72.196/ws
                    Source: random.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe.1.drString found in binary or memory: http://cert.ssl.com/SSLcom-SubCA-CodeSigning-RSA-4096-R1.cer0Q
                    Source: random.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe.1.drString found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
                    Source: random.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe.1.drString found in binary or memory: http://crls.ssl.com/SSLcom-SubCA-CodeSigning-RSA-4096-R1.crl0
                    Source: random.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe.1.drString found in binary or memory: http://crls.ssl.com/ssl.com-rsa-RootCA.crl0
                    Source: random.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe.1.drString found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
                    Source: random.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe.1.drString found in binary or memory: http://ocsp.sectigo.com0
                    Source: random.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe.1.drString found in binary or memory: http://ocsps.ssl.com0
                    Source: random.exe, 00000001.00000002.1644178211.0000000000F2E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
                    Source: random.exe, 00000001.00000003.1312934026.0000000004CA0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/Nhttp://www.borland.com/namespaces/Types
                    Source: random.exe, 00000001.00000002.1644178211.0000000000F2E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.borland.com/namespaces/Types
                    Source: random.exe, 00000001.00000002.1648396081.0000000005460000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.borland.com/namespaces/Types-IAppServerSOAP
                    Source: random.exe, 00000001.00000003.1312934026.0000000004CA0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.borland.com/namespaces/Typeslhttp://www.borland.com/namespaces/Types-IAppServerSOAPU
                    Source: random.exe, random.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 00000003.00000000.1599518700.0000000000401000.00000020.00000001.01000000.00000006.sdmp, svchost015.exe.1.drString found in binary or memory: http://www.x-ways.net/order
                    Source: random.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 00000003.00000000.1599518700.0000000000401000.00000020.00000001.01000000.00000006.sdmp, svchost015.exe.1.drString found in binary or memory: http://www.x-ways.net/order.html-d.htmlS
                    Source: random.exe, random.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 00000003.00000000.1599518700.0000000000401000.00000020.00000001.01000000.00000006.sdmp, svchost015.exe.1.drString found in binary or memory: http://www.x-ways.net/winhex/license
                    Source: random.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 00000003.00000000.1599518700.0000000000401000.00000020.00000001.01000000.00000006.sdmp, svchost015.exe.1.drString found in binary or memory: http://www.x-ways.net/winhex/license-d-f.htmlS
                    Source: random.exe, random.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 00000003.00000000.1599518700.0000000000401000.00000020.00000001.01000000.00000006.sdmp, svchost015.exe.1.drString found in binary or memory: http://www.x-ways.net/winhex/subscribe
                    Source: random.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 00000003.00000000.1599518700.0000000000401000.00000020.00000001.01000000.00000006.sdmp, svchost015.exe.1.drString found in binary or memory: http://www.x-ways.net/winhex/subscribe-d.htmlU
                    Source: svchost015.exe, 00000003.00000002.2554279889.00000000006AC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive.usercontent.google.com/
                    Source: svchost015.exe, 00000003.00000002.2554279889.00000000006AC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive.usercontent.google.com/download?id=1YBVIDkZgygNfUU2rbJXXCYdrzay5rMdY&export=download&a
                    Source: random.exe, random.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 00000003.00000000.1599518700.0000000000401000.00000020.00000001.01000000.00000006.sdmp, svchost015.exe.1.drString found in binary or memory: https://github.com/tesseract-ocr/tessdata/
                    Source: random.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe.1.drString found in binary or memory: https://sectigo.com/CPS0
                    Source: random.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe.1.drString found in binary or memory: https://www.ssl.com/repository0
                    Source: random.exe, random.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 00000003.00000000.1599518700.0000000000401000.00000020.00000001.01000000.00000006.sdmp, svchost015.exe.1.drString found in binary or memory: https://www.x-ways.net/forensics/x-tensions.html
                    Source: random.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 00000003.00000000.1599518700.0000000000401000.00000020.00000001.01000000.00000006.sdmp, svchost015.exe.1.drString found in binary or memory: https://www.x-ways.net/forensics/x-tensions.htmlf
                    Source: random.exe, random.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 00000003.00000000.1599518700.0000000000401000.00000020.00000001.01000000.00000006.sdmp, svchost015.exe.1.drString found in binary or memory: https://www.x-ways.net/winhex/forum/
                    Source: random.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 00000003.00000000.1599518700.0000000000401000.00000020.00000001.01000000.00000006.sdmp, svchost015.exe.1.drString found in binary or memory: https://www.x-ways.net/winhex/forum/www.x-ways.net/winhex/templates/www.x-ways.net/dongle_protection
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49695 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49695
                    Source: unknownHTTPS traffic detected: 142.250.68.225:443 -> 192.168.2.5:49695 version: TLS 1.2
                    Source: Yara matchFile source: 3.0.svchost015.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: random.exe PID: 7704, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: svchost015.exe PID: 6488, type: MEMORYSTR
                    Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\svchost015.exe, type: DROPPED

                    System Summary

                    barindex
                    Source: random.exeStatic PE information: section name:
                    Source: random.exeStatic PE information: section name: .idata
                    Source: random.exeStatic PE information: section name:
                    Source: C:\Users\user\Desktop\random.exeCode function: 1_2_05A2254C1_2_05A2254C
                    Source: C:\Users\user\Desktop\random.exeCode function: 1_2_05A222E01_2_05A222E0
                    Source: C:\Users\user\Desktop\random.exeCode function: 1_2_05A26D001_2_05A26D00
                    Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Temp\svchost015.exe 7824B50ACDD144764DAC7445A4067B35CF0FEF619E451045AB6C1F54F5653A5B
                    Source: random.exeBinary or memory string: OriginalFilename vs random.exe
                    Source: random.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameWINHEX.EXE0 vs random.exe
                    Source: random.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
                    Source: random.exeStatic PE information: Section: ZLIB complexity 0.9986920777279522
                    Source: svchost015.exe.1.drBinary string: \Device\CDROM
                    Source: svchost015.exe.1.drBinary string: \Device\PhysicalMemory
                    Source: svchost015.exe.1.drBinary string: \Device\PhysicalMemoryU
                    Source: svchost015.exe.1.drBinary string: ol, por favorI&taliano, per favore&Portugues, por favorPo&lski*.*.prj.xfcwhxvmem.pos.settings.zip.e01.dd001.ctr.txt.png.mem.memservice_workeredgetmp.tmpemlmsg.jpgheic*.pdf;*.ps;*.tif;*.jpg;*.png;*.gif;*.bmp.htmlhtmlxmlsqlitesqlitedbregistryolk14messageedbsnssevtevtxplistbplist*.xhdTesseractOCRExcireExcire ForensicsExcire.exe.\!imagespst,ost,edb,dbx,pfc,mbox,eml,emlx,mht,mim,msg,olk14msgsource,olk14message,olk14msgattach,olk15msgattach,olk15msgsource,olk15message,oft,mbs,tnefzip,zipx,7z,rar,tar,gz,tgz,bzip,bz2docx,xlsx,pptx,ppsx,odt,ods,odb,odg,odf,odp,key,numbers,pages,xps,oxps,opendoc,sxw,sxg,sxc,stc,sxm,sxi,sxd,std,stw,sxm,hwpxufdr,ova,gbp,odm,a2w,kmz,kpr,pxl2,bbb,idml,cdr,sbb,notebook,mmap,spd,cdmz,mwb,nbak,pez,artx,cmap,sh3d,dpp,snb,dbk,sps,spv,wpp,jnxthmx,war,otp,xap,dwfx,epub,btapp,u3p,nth,ibooks,3dxml,htmlz,cbz,ear,potx,ppam,xltx,xlsm,dotx,docm,dotx,vsdx,gadget,rbf,eftx,gg,ottjar,apk,ipa,appx,crx,cabzxp,ots,wmz,air,accft,vssx,ipcc,ipsw,xpi;*.docx;*.pptx;*.xlsx;*.vsdx;*.vsdm;*.odt;*.odp;*.ods*.xls;*.xlsx;*.odsNEARNTNRFlexFilterANDOR (=offline)XWF_MTX_Alt Gr +Ctrl +Shift +Space +Ctrl+Alt +HeaderBlank line(s) found.Power down after x minutesFallback code page for plain text*\\\\?\\\.\\\?\Volume{\Device\HarddiskVolume\Device\CdRom... .. FILEBAAD($MFT) WofCompressedDataIndex Record$EFS.PFILENTFS: EA(EA)NO NAME > 0x100x10 < 0x30Unable to terminate worker thread.X-Ways Decompressed [block hash values] [PhotoDNA] [FuzZyDoc]PhotoDNAFuzZyDoc_newTeamsMessagesDataTeamsMeetingsRecoverable Items\DeletionsTop of Personal FoldersSenRec.dirPasswords.txtSearch Terms.txtNewUsers.dirKeywordsLockSpecial Interest.sectorX-Ways SessionSleep(0) Frequency (0..100)non-existent sector debug info123123|123|1234|12345|123456|1234567|12345678|123456789|987654321|abc123|123abc|121212|000000|666666|qwerty|password|password1|iloveyou|monkey|dragon|qwertyuiop-------- *** ---*** ***nLicID& --> --> .journal.exclude.badblocksFile mode:Sequential #TOCBLOCKVMDBVBLKContainerFILETIMEZone.Identifier[ZoneTransfer]System Volume InformationNot enough space for metadata at offset<html>
                    Source: svchost015.exe.1.drBinary string: \Device\harddisk
                    Source: svchost015.exe.1.drBinary string: \Device\Floppy
                    Source: svchost015.exe.1.drBinary string: \Device\Floppy\Device\CDROM\Device\harddisk\partition0SQ
                    Source: classification engineClassification label: mal100.troj.evad.winEXE@3/2@1/2
                    Source: C:\Users\user\AppData\Local\Temp\svchost015.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\text[1]Jump to behavior
                    Source: C:\Users\user\Desktop\random.exeFile created: C:\Users\user\AppData\Local\Temp\svchost015.exeJump to behavior
                    Source: Yara matchFile source: 3.0.svchost015.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000003.00000000.1599518700.0000000000401000.00000020.00000001.01000000.00000006.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\svchost015.exe, type: DROPPED
                    Source: C:\Users\user\Desktop\random.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                    Source: C:\Users\user\Desktop\random.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : Select Name from Win32_Processor
                    Source: C:\Users\user\Desktop\random.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                    Source: random.exeVirustotal: Detection: 27%
                    Source: random.exeReversingLabs: Detection: 44%
                    Source: random.exeString found in binary or memory: 3Cannot find '%s'. Please, re-install this application
                    Source: random.exeString found in binary or memory: If you think that might be the case, please hold the Shift key when interpreting/adding the image again.
                    Source: random.exeString found in binary or memory: remember that you can easily specify the sector size to assume for an image (hold the Shift key while interpreting/adding it).
                    Source: random.exeString found in binary or memory: You can try holding the Shift key when interpreting the image/adding it to the case.
                    Source: random.exeString found in binary or memory: 81ADC/ADD/AND/CMP/OR/SBB/SUB/XOR
                    Source: random.exeString found in binary or memory: 83ADC/ADD/AND/CMP/OR/SBB/SUB/XOR
                    Source: random.exeString found in binary or memory: 80ADC/ADD/AND/CMP/OR/SBB/SUB/XOR
                    Source: random.exeString found in binary or memory: Cannot load driver. Please re-install it by executing Dokan.exe.
                    Source: unknownProcess created: C:\Users\user\Desktop\random.exe "C:\Users\user\Desktop\random.exe"
                    Source: C:\Users\user\Desktop\random.exeProcess created: C:\Users\user\AppData\Local\Temp\svchost015.exe "C:\Users\user\Desktop\random.exe"
                    Source: C:\Users\user\Desktop\random.exeProcess created: C:\Users\user\AppData\Local\Temp\svchost015.exe "C:\Users\user\Desktop\random.exe"Jump to behavior
                    Source: C:\Users\user\Desktop\random.exeSection loaded: apphelp.dllJump to behavior
                    Source: C:\Users\user\Desktop\random.exeSection loaded: winmm.dllJump to behavior
                    Source: C:\Users\user\Desktop\random.exeSection loaded: version.dllJump to behavior
                    Source: C:\Users\user\Desktop\random.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Users\user\Desktop\random.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Users\user\Desktop\random.exeSection loaded: wbemcomn.dllJump to behavior
                    Source: C:\Users\user\Desktop\random.exeSection loaded: sxs.dllJump to behavior
                    Source: C:\Users\user\Desktop\random.exeSection loaded: napinsp.dllJump to behavior
                    Source: C:\Users\user\Desktop\random.exeSection loaded: pnrpnsp.dllJump to behavior
                    Source: C:\Users\user\Desktop\random.exeSection loaded: wshbth.dllJump to behavior
                    Source: C:\Users\user\Desktop\random.exeSection loaded: nlaapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\random.exeSection loaded: iphlpapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\random.exeSection loaded: mswsock.dllJump to behavior
                    Source: C:\Users\user\Desktop\random.exeSection loaded: dnsapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\random.exeSection loaded: winrnr.dllJump to behavior
                    Source: C:\Users\user\Desktop\random.exeSection loaded: fwpuclnt.dllJump to behavior
                    Source: C:\Users\user\Desktop\random.exeSection loaded: rasadhlp.dllJump to behavior
                    Source: C:\Users\user\Desktop\random.exeSection loaded: amsi.dllJump to behavior
                    Source: C:\Users\user\Desktop\random.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Users\user\Desktop\random.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\svchost015.exeSection loaded: apphelp.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\svchost015.exeSection loaded: wininet.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\svchost015.exeSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\svchost015.exeSection loaded: iertutil.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\svchost015.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\svchost015.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\svchost015.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\svchost015.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\svchost015.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\svchost015.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\svchost015.exeSection loaded: winhttp.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\svchost015.exeSection loaded: mswsock.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\svchost015.exeSection loaded: iphlpapi.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\svchost015.exeSection loaded: winnsi.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\svchost015.exeSection loaded: urlmon.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\svchost015.exeSection loaded: srvcli.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\svchost015.exeSection loaded: netutils.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\svchost015.exeSection loaded: dnsapi.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\svchost015.exeSection loaded: rasadhlp.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\svchost015.exeSection loaded: fwpuclnt.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\svchost015.exeSection loaded: schannel.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\svchost015.exeSection loaded: mskeyprotect.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\svchost015.exeSection loaded: ntasn1.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\svchost015.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\svchost015.exeSection loaded: dpapi.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\svchost015.exeSection loaded: cryptsp.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\svchost015.exeSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\svchost015.exeSection loaded: gpapi.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\svchost015.exeSection loaded: ncrypt.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\svchost015.exeSection loaded: ncryptsslp.dllJump to behavior
                    Source: C:\Users\user\Desktop\random.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\InProcServer32Jump to behavior
                    Source: random.exeStatic file information: File size 5082112 > 1048576
                    Source: random.exeStatic PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x299000
                    Source: random.exeStatic PE information: Raw size of crvwvere is bigger than: 0x100000 < 0x1e8800

                    Data Obfuscation

                    barindex
                    Source: C:\Users\user\Desktop\random.exeUnpacked PE file: 1.2.random.exe.400000.0.unpack :EW;.rsrc:W;.idata :W; :EW;crvwvere:EW;rioauvav:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;crvwvere:EW;rioauvav:EW;.taggant:EW;
                    Source: initial sampleStatic PE information: section where entry point is pointing to: .taggant
                    Source: random.exeStatic PE information: real checksum: 0x4dee27 should be: 0x4de813
                    Source: random.exeStatic PE information: section name:
                    Source: random.exeStatic PE information: section name: .idata
                    Source: random.exeStatic PE information: section name:
                    Source: random.exeStatic PE information: section name: crvwvere
                    Source: random.exeStatic PE information: section name: rioauvav
                    Source: random.exeStatic PE information: section name: .taggant
                    Source: C:\Users\user\Desktop\random.exeCode function: 1_2_05A1A47C push ecx; mov dword ptr [esp], eax1_2_05A1A480
                    Source: C:\Users\user\Desktop\random.exeCode function: 1_2_05A2518C push 00415A78h; ret 1_2_05A251B0
                    Source: C:\Users\user\Desktop\random.exeCode function: 1_2_05A22120 push ecx; mov dword ptr [esp], ecx1_2_05A22125
                    Source: C:\Users\user\Desktop\random.exeCode function: 1_2_05A1508C push 0040599Dh; ret 1_2_05A150D5
                    Source: C:\Users\user\Desktop\random.exeCode function: 1_2_05A1637A push 00406C68h; ret 1_2_05A163A0
                    Source: C:\Users\user\Desktop\random.exeCode function: 1_2_05A162B4 push 00406BA0h; ret 1_2_05A162D8
                    Source: C:\Users\user\Desktop\random.exeCode function: 1_2_05A15294 push 00405B80h; ret 1_2_05A152B8
                    Source: C:\Users\user\Desktop\random.exeCode function: 1_2_05A162EC push 00406BD8h; ret 1_2_05A16310
                    Source: C:\Users\user\Desktop\random.exeCode function: 1_2_05A22264 push 00412B50h; ret 1_2_05A22288
                    Source: C:\Users\user\Desktop\random.exeCode function: 1_2_05A17254 push 00407B40h; ret 1_2_05A17278
                    Source: C:\Users\user\Desktop\random.exeCode function: 1_2_05A1525C push 00405B48h; ret 1_2_05A15280
                    Source: C:\Users\user\Desktop\random.exeCode function: 1_2_05A25D9E push 0041668Ch; ret 1_2_05A25DC4
                    Source: C:\Users\user\Desktop\random.exeCode function: 1_2_05A12D4C push eax; ret 1_2_05A12D88
                    Source: C:\Users\user\Desktop\random.exeCode function: 1_2_05A21C94 push 00412580h; ret 1_2_05A21CB8
                    Source: C:\Users\user\Desktop\random.exeCode function: 1_2_05A22C9E push 0041358Ch; ret 1_2_05A22CC4
                    Source: C:\Users\user\Desktop\random.exeCode function: 1_2_05A26FC0 push 004178ACh; ret 1_2_05A26FE4
                    Source: C:\Users\user\Desktop\random.exeCode function: 1_2_05A17E56 push 00408744h; ret 1_2_05A17E7C
                    Source: C:\Users\user\Desktop\random.exeCode function: 1_2_05A2291C push ecx; mov dword ptr [esp], ecx1_2_05A2291F
                    Source: C:\Users\user\Desktop\random.exeCode function: 1_2_05A20890 push 0041117Ch; ret 1_2_05A208B4
                    Source: C:\Users\user\Desktop\random.exeCode function: 1_2_05A20858 push 00411144h; ret 1_2_05A2087C
                    Source: C:\Users\user\Desktop\random.exeCode function: 1_2_05A20B24 push 00411410h; ret 1_2_05A20B48
                    Source: C:\Users\user\Desktop\random.exeCode function: 1_2_05A1CB0C push 0040D3FCh; ret 1_2_05A1CB34
                    Source: C:\Users\user\Desktop\random.exeCode function: 1_2_05A20AEC push 004113D8h; ret 1_2_05A20B10
                    Source: C:\Users\user\Desktop\random.exeCode function: 1_2_05A21A50 push 0041233Ch; ret 1_2_05A21A74
                    Source: random.exeStatic PE information: section name: entropy: 7.9733396056544
                    Source: random.exeStatic PE information: section name: crvwvere entropy: 7.892877819014468
                    Source: C:\Users\user\Desktop\random.exeFile created: C:\Users\user\AppData\Local\Temp\svchost015.exeJump to dropped file

                    Boot Survival

                    barindex
                    Source: C:\Users\user\Desktop\random.exeWindow searched: window name: FilemonClassJump to behavior
                    Source: C:\Users\user\Desktop\random.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                    Source: C:\Users\user\Desktop\random.exeWindow searched: window name: RegmonClassJump to behavior
                    Source: C:\Users\user\Desktop\random.exeWindow searched: window name: FilemonClassJump to behavior
                    Source: C:\Users\user\Desktop\random.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                    Source: C:\Users\user\Desktop\random.exeWindow searched: window name: RegmonclassJump to behavior
                    Source: C:\Users\user\Desktop\random.exeWindow searched: window name: FilemonclassJump to behavior
                    Source: C:\Users\user\Desktop\random.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                    Source: C:\Users\user\Desktop\random.exeWindow searched: window name: RegmonclassJump to behavior
                    Source: C:\Users\user\Desktop\random.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                    Malware Analysis System Evasion

                    barindex
                    Source: C:\Users\user\Desktop\random.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
                    Source: C:\Users\user\Desktop\random.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9D24ED second address: 9D24F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9D24F3 second address: 9D24F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9D24F7 second address: 9D24FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9D24FD second address: 9D250A instructions: 0x00000000 rdtsc 0x00000002 je 00007F3070BEB5D8h 0x00000008 pushad 0x00000009 popad 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9D250A second address: 9D2524 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F30707E4B3Fh 0x00000010 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9D2524 second address: 9D252E instructions: 0x00000000 rdtsc 0x00000002 je 00007F3070BEB5F5h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9C4DD1 second address: 9C4DD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9D150D second address: 9D1521 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push esi 0x00000006 jmp 00007F3070BEB5DBh 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9D1521 second address: 9D153D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F30707E4B46h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9D153D second address: 9D1541 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9D1541 second address: 9D1545 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9D1688 second address: 9D1694 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jng 00007F3070BEB5D6h 0x0000000c rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9D1846 second address: 9D185E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F30707E4B43h 0x00000009 popad 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9D19A6 second address: 9D19AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9D19AB second address: 9D19BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F30707E4B3Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9D19BF second address: 9D19C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9D19C3 second address: 9D19F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F30707E4B3Ch 0x00000007 jp 00007F30707E4B36h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 jmp 00007F30707E4B43h 0x00000017 push ecx 0x00000018 push edi 0x00000019 pop edi 0x0000001a pushad 0x0000001b popad 0x0000001c pop ecx 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9D19F8 second address: 9D19FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9D1B3C second address: 9D1B60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jmp 00007F30707E4B45h 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007F30707E4B36h 0x00000014 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9D5BEB second address: 9D5C1B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3070BEB5DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push esi 0x0000000c push eax 0x0000000d pushad 0x0000000e popad 0x0000000f pop eax 0x00000010 pop esi 0x00000011 nop 0x00000012 xor dword ptr [ebp+122D1940h], ebx 0x00000018 push 00000000h 0x0000001a mov edx, dword ptr [ebp+122D38C1h] 0x00000020 push CDEF103Bh 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 push esi 0x0000002a pop esi 0x0000002b rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9D5C1B second address: 9D5C25 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F30707E4B36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9D5C25 second address: 9D5C8E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F3070BEB5DBh 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b add dword ptr [esp], 3210F045h 0x00000012 or edi, dword ptr [ebp+122D3721h] 0x00000018 push 00000003h 0x0000001a mov dword ptr [ebp+122D1954h], eax 0x00000020 add dword ptr [ebp+122D17F3h], ecx 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push edx 0x0000002b call 00007F3070BEB5D8h 0x00000030 pop edx 0x00000031 mov dword ptr [esp+04h], edx 0x00000035 add dword ptr [esp+04h], 0000001Ah 0x0000003d inc edx 0x0000003e push edx 0x0000003f ret 0x00000040 pop edx 0x00000041 ret 0x00000042 mov cx, di 0x00000045 push 00000003h 0x00000047 mov esi, dword ptr [ebp+122D35CDh] 0x0000004d push B967C171h 0x00000052 pushad 0x00000053 push eax 0x00000054 push edx 0x00000055 jnl 00007F3070BEB5D6h 0x0000005b rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9D5C8E second address: 9D5D15 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F30707E4B45h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jbe 00007F30707E4B38h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 xor dword ptr [esp], 7967C171h 0x00000019 lea ebx, dword ptr [ebp+12450ABDh] 0x0000001f push 00000000h 0x00000021 push edi 0x00000022 call 00007F30707E4B38h 0x00000027 pop edi 0x00000028 mov dword ptr [esp+04h], edi 0x0000002c add dword ptr [esp+04h], 0000001Ch 0x00000034 inc edi 0x00000035 push edi 0x00000036 ret 0x00000037 pop edi 0x00000038 ret 0x00000039 mov dh, 22h 0x0000003b push ecx 0x0000003c sub dword ptr [ebp+122D1C4Dh], ecx 0x00000042 pop edi 0x00000043 xchg eax, ebx 0x00000044 pushad 0x00000045 pushad 0x00000046 pushad 0x00000047 popad 0x00000048 jmp 00007F30707E4B3Eh 0x0000004d popad 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007F30707E4B44h 0x00000055 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9D5D83 second address: 9D5DC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop esi 0x00000006 push eax 0x00000007 push ecx 0x00000008 push ecx 0x00000009 jg 00007F3070BEB5D6h 0x0000000f pop ecx 0x00000010 pop ecx 0x00000011 nop 0x00000012 mov dword ptr [ebp+122D194Dh], edx 0x00000018 push 00000000h 0x0000001a mov dword ptr [ebp+122D18ECh], esi 0x00000020 push CF317A0Dh 0x00000025 pushad 0x00000026 jmp 00007F3070BEB5E8h 0x0000002b push ebx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9D5DC4 second address: 9D5E33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 add dword ptr [esp], 30CE8673h 0x0000000d pushad 0x0000000e call 00007F30707E4B3Ch 0x00000013 adc ah, FFFFFF9Eh 0x00000016 pop ebx 0x00000017 ja 00007F30707E4B3Bh 0x0000001d popad 0x0000001e push 00000003h 0x00000020 mov dword ptr [ebp+122DB734h], ebx 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push ebx 0x0000002b call 00007F30707E4B38h 0x00000030 pop ebx 0x00000031 mov dword ptr [esp+04h], ebx 0x00000035 add dword ptr [esp+04h], 00000014h 0x0000003d inc ebx 0x0000003e push ebx 0x0000003f ret 0x00000040 pop ebx 0x00000041 ret 0x00000042 mov dx, 0B79h 0x00000046 push 00000003h 0x00000048 sub edx, 0B50D8A6h 0x0000004e push 639FF20Fh 0x00000053 push eax 0x00000054 push edx 0x00000055 push ecx 0x00000056 jmp 00007F30707E4B3Ah 0x0000005b pop ecx 0x0000005c rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9D5E33 second address: 9D5EA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 5C600DF1h 0x00000011 push 00000000h 0x00000013 push edi 0x00000014 call 00007F3070BEB5D8h 0x00000019 pop edi 0x0000001a mov dword ptr [esp+04h], edi 0x0000001e add dword ptr [esp+04h], 00000017h 0x00000026 inc edi 0x00000027 push edi 0x00000028 ret 0x00000029 pop edi 0x0000002a ret 0x0000002b mov esi, edi 0x0000002d mov ch, bl 0x0000002f lea ebx, dword ptr [ebp+12450AC6h] 0x00000035 push 00000000h 0x00000037 push ecx 0x00000038 call 00007F3070BEB5D8h 0x0000003d pop ecx 0x0000003e mov dword ptr [esp+04h], ecx 0x00000042 add dword ptr [esp+04h], 00000018h 0x0000004a inc ecx 0x0000004b push ecx 0x0000004c ret 0x0000004d pop ecx 0x0000004e ret 0x0000004f sub si, 70C1h 0x00000054 add dx, A308h 0x00000059 mov si, di 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f push ebx 0x00000060 jnc 00007F3070BEB5D6h 0x00000066 pop ebx 0x00000067 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9D5EA5 second address: 9D5EAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9D6001 second address: 9D6029 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F3070BEB5E3h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jnl 00007F3070BEB5EFh 0x00000012 push eax 0x00000013 push edx 0x00000014 js 00007F3070BEB5D6h 0x0000001a rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9E6F73 second address: 9E6F77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9E6F77 second address: 9E6F7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9F6489 second address: 9F64AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ecx 0x00000008 jmp 00007F30707E4B48h 0x0000000d pop ecx 0x0000000e pop ecx 0x0000000f pushad 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9F64AF second address: 9F64B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9F64B8 second address: 9F64BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9F64BE second address: 9F64C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9F4511 second address: 9F4531 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F30707E4B49h 0x0000000b popad 0x0000000c rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9F4531 second address: 9F4557 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3070BEB5DEh 0x00000008 jmp 00007F3070BEB5E3h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9F4557 second address: 9F4562 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9F4562 second address: 9F4578 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F3070BEB5D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d push ecx 0x0000000e jl 00007F3070BEB5D6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9F46CB second address: 9F46CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9F46CF second address: 9F46D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9F46D7 second address: 9F46F6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007F30707E4B42h 0x0000000a pop edi 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9F46F6 second address: 9F472C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F3070BEB5D6h 0x0000000a jmp 00007F3070BEB5E3h 0x0000000f jmp 00007F3070BEB5E8h 0x00000014 popad 0x00000015 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9F486E second address: 9F4893 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F30707E4B49h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 pop esi 0x00000011 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9F4893 second address: 9F48A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007F3070BEB5DAh 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9F4BCB second address: 9F4BD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9F4BD4 second address: 9F4BD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9F4BD8 second address: 9F4C0E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F30707E4B45h 0x00000007 jmp 00007F30707E4B45h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 js 00007F30707E4B36h 0x00000016 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9F4C0E second address: 9F4C12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9F5006 second address: 9F5023 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 jg 00007F30707E4B46h 0x0000000d rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9F5152 second address: 9F5168 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F3070BEB5DCh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9F52D7 second address: 9F52DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9F52DB second address: 9F5302 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jg 00007F3070BEB5D8h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 push edi 0x00000012 push ebx 0x00000013 jmp 00007F3070BEB5E2h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9F558D second address: 9F55A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F30707E4B3Dh 0x0000000a push esi 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9F55A9 second address: 9F55B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop ecx 0x00000007 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9E93E4 second address: 9E93FB instructions: 0x00000000 rdtsc 0x00000002 ja 00007F30707E4B42h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9E93FB second address: 9E9401 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9C6895 second address: 9C68C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F30707E4B45h 0x00000009 pop ebx 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007F30707E4B3Dh 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9C68C1 second address: 9C68DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F3070BEB5D6h 0x0000000a pop ebx 0x0000000b pushad 0x0000000c je 00007F3070BEB5D6h 0x00000012 push edi 0x00000013 pop edi 0x00000014 jnl 00007F3070BEB5D6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9F6060 second address: 9F6064 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9F6064 second address: 9F6083 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a jmp 00007F3070BEB5DEh 0x0000000f push edx 0x00000010 pop edx 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9F6083 second address: 9F6089 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9F6089 second address: 9F608D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9F608D second address: 9F6093 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9E93EE second address: 9E93F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9E93F4 second address: 9E93FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9F632F second address: 9F6338 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9F6338 second address: 9F6343 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F30707E4B36h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9F7A8C second address: 9F7A90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9F7A90 second address: 9F7AA9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F30707E4B3Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pushad 0x0000000f popad 0x00000010 pop ecx 0x00000011 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9F8B71 second address: 9F8B7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F3070BEB5D6h 0x0000000a popad 0x0000000b rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9F8B7C second address: 9F8B86 instructions: 0x00000000 rdtsc 0x00000002 je 00007F30707E4B3Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A03303 second address: A03313 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push edi 0x00000006 pop edi 0x00000007 pop edx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A03313 second address: A03319 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A03319 second address: A0331D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A0331D second address: A03325 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A02751 second address: A0275E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jbe 00007F3070BEB5E6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A028F4 second address: A028FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A028FA second address: A02908 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jp 00007F3070BEB5D6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A02A52 second address: A02A58 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9F72A9 second address: 9F72AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A02FA4 second address: A02FC0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F30707E4B3Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jp 00007F30707E4B36h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A02FC0 second address: A02FC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A02FC6 second address: A02FCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A02FCE second address: A02FD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A03199 second address: A0319D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A0319D second address: A031C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 pushad 0x00000008 jg 00007F3070BEB5E8h 0x0000000e je 00007F3070BEB5D8h 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A031C9 second address: A031CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A031CF second address: A031D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A031D3 second address: A031D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A03AE8 second address: A03AF1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A03AF1 second address: A03B13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F30707E4B45h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push eax 0x00000010 pop eax 0x00000011 pop eax 0x00000012 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A03B13 second address: A03B3F instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3070BEB5EFh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A03B3F second address: A03B43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A03B43 second address: A03B47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A03B47 second address: A03B56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A03B56 second address: A03B66 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3070BEB5DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A03E8B second address: A03E8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A03E8F second address: A03EA7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3070BEB5E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A0402E second address: A04034 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A04034 second address: A04039 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A04039 second address: A0403F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A046EF second address: A04727 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 push 00000000h 0x0000000b push ebx 0x0000000c call 00007F3070BEB5D8h 0x00000011 pop ebx 0x00000012 mov dword ptr [esp+04h], ebx 0x00000016 add dword ptr [esp+04h], 00000014h 0x0000001e inc ebx 0x0000001f push ebx 0x00000020 ret 0x00000021 pop ebx 0x00000022 ret 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 jo 00007F3070BEB5E0h 0x0000002c jmp 00007F3070BEB5DAh 0x00000031 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A04817 second address: A0481D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A0481D second address: A04821 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A04821 second address: A0483A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c ja 00007F30707E4B36h 0x00000012 jo 00007F30707E4B36h 0x00000018 popad 0x00000019 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A0483A second address: A0483F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A0491E second address: A04924 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A04924 second address: A04928 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A04D05 second address: A04D0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A04D0B second address: A04D0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A04D0F second address: A04D4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b ja 00007F30707E4B3Ch 0x00000011 xchg eax, ebx 0x00000012 jmp 00007F30707E4B45h 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jne 00007F30707E4B3Ch 0x00000020 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A05228 second address: A05232 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F3070BEB5D6h 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A05C7E second address: A05C82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A05B53 second address: A05B6D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F3070BEB5DFh 0x00000010 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A05B6D second address: A05B73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A06D4A second address: A06D50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A09A1A second address: A09A9D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F30707E4B3Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007F30707E4B38h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 mov esi, edi 0x00000028 mov edi, dword ptr [ebp+122D36FDh] 0x0000002e push 00000000h 0x00000030 je 00007F30707E4B3Ch 0x00000036 sub dword ptr [ebp+12478AC8h], esi 0x0000003c push 00000000h 0x0000003e push 00000000h 0x00000040 push edx 0x00000041 call 00007F30707E4B38h 0x00000046 pop edx 0x00000047 mov dword ptr [esp+04h], edx 0x0000004b add dword ptr [esp+04h], 00000014h 0x00000053 inc edx 0x00000054 push edx 0x00000055 ret 0x00000056 pop edx 0x00000057 ret 0x00000058 pushad 0x00000059 sub bx, 8DEBh 0x0000005e mov dword ptr [ebp+122D18BFh], ebx 0x00000064 popad 0x00000065 mov dword ptr [ebp+122D2465h], eax 0x0000006b mov edi, 46131807h 0x00000070 xchg eax, ebx 0x00000071 push edx 0x00000072 push eax 0x00000073 push edx 0x00000074 jc 00007F30707E4B36h 0x0000007a rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A09A9D second address: A09ADD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3070BEB5E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d jmp 00007F3070BEB5DAh 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pushad 0x00000016 jmp 00007F3070BEB5E4h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A080E4 second address: A080E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A0A1A5 second address: A0A1D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3070BEB5E1h 0x00000008 jmp 00007F3070BEB5E3h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A0A1D6 second address: A0A1DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A0A1DA second address: A0A1E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A0A1E0 second address: A0A1E5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A0BFB9 second address: A0BFBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A0BFBF second address: A0BFD3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F30707E4B3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9C842E second address: 9C844A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3070BEB5DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F3070BEB5DDh 0x0000000e rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9C844A second address: 9C845F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F30707E4B3Eh 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A0AD55 second address: A0AD5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F3070BEB5D6h 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A0E6C5 second address: A0E6CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A0E6CB second address: A0E74F instructions: 0x00000000 rdtsc 0x00000002 jo 00007F3070BEB5D8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F3070BEB5DAh 0x00000012 nop 0x00000013 jnl 00007F3070BEB5DBh 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push ecx 0x0000001e call 00007F3070BEB5D8h 0x00000023 pop ecx 0x00000024 mov dword ptr [esp+04h], ecx 0x00000028 add dword ptr [esp+04h], 00000015h 0x00000030 inc ecx 0x00000031 push ecx 0x00000032 ret 0x00000033 pop ecx 0x00000034 ret 0x00000035 call 00007F3070BEB5DCh 0x0000003a mov dword ptr [ebp+122D192Eh], edi 0x00000040 pop esi 0x00000041 push 00000000h 0x00000043 push 00000000h 0x00000045 push ebx 0x00000046 call 00007F3070BEB5D8h 0x0000004b pop ebx 0x0000004c mov dword ptr [esp+04h], ebx 0x00000050 add dword ptr [esp+04h], 00000016h 0x00000058 inc ebx 0x00000059 push ebx 0x0000005a ret 0x0000005b pop ebx 0x0000005c ret 0x0000005d mov si, 26CAh 0x00000061 push eax 0x00000062 push eax 0x00000063 push edx 0x00000064 jbe 00007F3070BEB5D8h 0x0000006a push ecx 0x0000006b pop ecx 0x0000006c rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A1433E second address: A14344 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A1368A second address: A1369B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jc 00007F3070BEB5D6h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A1450F second address: A1459C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jl 00007F30707E4B3Ch 0x0000000b je 00007F30707E4B36h 0x00000011 popad 0x00000012 nop 0x00000013 jmp 00007F30707E4B43h 0x00000018 push dword ptr fs:[00000000h] 0x0000001f push 00000000h 0x00000021 push edx 0x00000022 call 00007F30707E4B38h 0x00000027 pop edx 0x00000028 mov dword ptr [esp+04h], edx 0x0000002c add dword ptr [esp+04h], 00000015h 0x00000034 inc edx 0x00000035 push edx 0x00000036 ret 0x00000037 pop edx 0x00000038 ret 0x00000039 movzx ebx, dx 0x0000003c mov dword ptr fs:[00000000h], esp 0x00000043 mov ebx, dword ptr [ebp+122D386Dh] 0x00000049 mov eax, dword ptr [ebp+122D003Dh] 0x0000004f mov ebx, 47AFDCD8h 0x00000054 push FFFFFFFFh 0x00000056 add edi, 7D573FFBh 0x0000005c sub dword ptr [ebp+122D2CF2h], edi 0x00000062 push eax 0x00000063 pushad 0x00000064 je 00007F30707E4B44h 0x0000006a jmp 00007F30707E4B3Eh 0x0000006f push eax 0x00000070 push edx 0x00000071 push eax 0x00000072 push edx 0x00000073 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A1459C second address: A145A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A17251 second address: A1725B instructions: 0x00000000 rdtsc 0x00000002 jc 00007F30707E4B3Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A163C5 second address: A163CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A163CB second address: A163D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F30707E4B36h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A173C4 second address: A173C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A173C8 second address: A173CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A173CE second address: A17455 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3070BEB5DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov bl, 7Eh 0x0000000c push dword ptr fs:[00000000h] 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007F3070BEB5D8h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 00000017h 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d mov bx, D6A8h 0x00000031 mov di, 3E82h 0x00000035 mov dword ptr fs:[00000000h], esp 0x0000003c sub dword ptr [ebp+122D2294h], esi 0x00000042 mov eax, dword ptr [ebp+122D1085h] 0x00000048 jmp 00007F3070BEB5E0h 0x0000004d push FFFFFFFFh 0x0000004f pushad 0x00000050 mov bl, D8h 0x00000052 jp 00007F3070BEB5DCh 0x00000058 mov dword ptr [ebp+122D18A5h], edx 0x0000005e popad 0x0000005f push eax 0x00000060 push eax 0x00000061 push edx 0x00000062 push eax 0x00000063 push edx 0x00000064 jmp 00007F3070BEB5DAh 0x00000069 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A17455 second address: A1745B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A18440 second address: A18446 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A1D42D second address: A1D43C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F30707E4B3Bh 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A1E2E2 second address: A1E306 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3070BEB5E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jbe 00007F3070BEB5D6h 0x00000015 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A1E306 second address: A1E310 instructions: 0x00000000 rdtsc 0x00000002 js 00007F30707E4B36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A1C5CA second address: A1C5CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A1E310 second address: A1E36E instructions: 0x00000000 rdtsc 0x00000002 jc 00007F30707E4B3Ch 0x00000008 ja 00007F30707E4B36h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push edx 0x00000014 call 00007F30707E4B38h 0x00000019 pop edx 0x0000001a mov dword ptr [esp+04h], edx 0x0000001e add dword ptr [esp+04h], 0000001Bh 0x00000026 inc edx 0x00000027 push edx 0x00000028 ret 0x00000029 pop edx 0x0000002a ret 0x0000002b stc 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 pushad 0x00000031 cld 0x00000032 mov bh, dl 0x00000034 popad 0x00000035 xchg eax, esi 0x00000036 jmp 00007F30707E4B45h 0x0000003b push eax 0x0000003c push edi 0x0000003d push eax 0x0000003e push edx 0x0000003f jl 00007F30707E4B36h 0x00000045 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A1A517 second address: A1A530 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3070BEB5DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A1A530 second address: A1A537 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A1A537 second address: A1A5B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push esi 0x0000000a mov dword ptr [ebp+122D2B25h], ebx 0x00000010 pop ebx 0x00000011 push dword ptr fs:[00000000h] 0x00000018 call 00007F3070BEB5E4h 0x0000001d push edi 0x0000001e mov dword ptr [ebp+12462F8Eh], eax 0x00000024 pop ebx 0x00000025 pop edi 0x00000026 mov dword ptr fs:[00000000h], esp 0x0000002d sub dword ptr [ebp+1247830Fh], edx 0x00000033 mov eax, dword ptr [ebp+122D056Dh] 0x00000039 jmp 00007F3070BEB5E0h 0x0000003e push FFFFFFFFh 0x00000040 mov bx, 1E80h 0x00000044 mov dword ptr [ebp+122D2492h], edx 0x0000004a nop 0x0000004b push eax 0x0000004c push edx 0x0000004d push eax 0x0000004e push edx 0x0000004f jmp 00007F3070BEB5E3h 0x00000054 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A1A5B3 second address: A1A5B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A1F4F6 second address: A1F505 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 pushad 0x00000007 jc 00007F3070BEB5DCh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A1A5B7 second address: A1A5BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A1F505 second address: A1F511 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jnl 00007F3070BEB5D6h 0x0000000c rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A205CA second address: A205CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A205CF second address: A205D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A24E54 second address: A24E74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F30707E4B49h 0x0000000c rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A24E74 second address: A24E78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A28373 second address: A28379 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A28379 second address: A2837F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A2837F second address: A283A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F30707E4B46h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jbe 00007F30707E4B4Dh 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A2C822 second address: A2C84B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3070BEB5E7h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d je 00007F3070BEB5D6h 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A2C84B second address: A2C850 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A32E7F second address: A32EC2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3070BEB5E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push ecx 0x0000000e jg 00007F3070BEB5D8h 0x00000014 push edx 0x00000015 pop edx 0x00000016 pop ecx 0x00000017 mov eax, dword ptr [eax] 0x00000019 push eax 0x0000001a push ecx 0x0000001b push edx 0x0000001c pop edx 0x0000001d pop ecx 0x0000001e pop eax 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 jg 00007F3070BEB5D6h 0x0000002c push esi 0x0000002d pop esi 0x0000002e popad 0x0000002f rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A32F7C second address: A32F86 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F30707E4B3Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A33104 second address: 8589E2 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F3070BEB5D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 popad 0x00000011 xor dword ptr [esp], 67837021h 0x00000018 jmp 00007F3070BEB5E7h 0x0000001d push dword ptr [ebp+122D0009h] 0x00000023 jmp 00007F3070BEB5E3h 0x00000028 call dword ptr [ebp+122D182Eh] 0x0000002e pushad 0x0000002f xor dword ptr [ebp+122D2459h], edx 0x00000035 jmp 00007F3070BEB5E1h 0x0000003a xor eax, eax 0x0000003c jmp 00007F3070BEB5E6h 0x00000041 mov edx, dword ptr [esp+28h] 0x00000045 cld 0x00000046 mov dword ptr [ebp+122D3579h], eax 0x0000004c jp 00007F3070BEB5E1h 0x00000052 mov esi, 0000003Ch 0x00000057 jmp 00007F3070BEB5DFh 0x0000005c clc 0x0000005d add esi, dword ptr [esp+24h] 0x00000061 mov dword ptr [ebp+122D2459h], ecx 0x00000067 lodsw 0x00000069 sub dword ptr [ebp+122D2459h], esi 0x0000006f add eax, dword ptr [esp+24h] 0x00000073 pushad 0x00000074 mov esi, dword ptr [ebp+122D37ADh] 0x0000007a and esi, 5E453B8Fh 0x00000080 popad 0x00000081 mov ebx, dword ptr [esp+24h] 0x00000085 jmp 00007F3070BEB5E9h 0x0000008a nop 0x0000008b push eax 0x0000008c push edx 0x0000008d push edi 0x0000008e push edi 0x0000008f pop edi 0x00000090 pop edi 0x00000091 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A38399 second address: A3839D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A3839D second address: A383A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A383A3 second address: A383BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F30707E4B3Bh 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A383BA second address: A383C0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A383C0 second address: A383CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A383CA second address: A383D4 instructions: 0x00000000 rdtsc 0x00000002 js 00007F3070BEB5D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A0A1A1 second address: A0A1A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A389EB second address: A389F1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A389F1 second address: A389F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A389F7 second address: A38A08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3070BEB5DDh 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A38A08 second address: A38A15 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A38C8F second address: A38CA0 instructions: 0x00000000 rdtsc 0x00000002 je 00007F3070BEB5DCh 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A38DD1 second address: A38DEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jmp 00007F30707E4B3Fh 0x0000000b push esi 0x0000000c pop esi 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A394CD second address: A394D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A394D1 second address: A394FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F30707E4B49h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b js 00007F30707E4B3Ch 0x00000011 jbe 00007F30707E4B36h 0x00000017 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9CD337 second address: 9CD34A instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F3070BEB5DAh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9CD34A second address: 9CD358 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9CD358 second address: 9CD360 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9CD360 second address: 9CD365 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9CD365 second address: 9CD36F instructions: 0x00000000 rdtsc 0x00000002 js 00007F3070BEB5DEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A43B06 second address: A43B0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A43EEC second address: A43EF7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jbe 00007F3070BEB5D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A441BF second address: A441C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A441C5 second address: A4420A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3070BEB5E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pop edx 0x00000010 jnp 00007F3070BEB5DCh 0x00000016 pushad 0x00000017 jns 00007F3070BEB5D6h 0x0000001d jmp 00007F3070BEB5DDh 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A4434C second address: A44350 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A44350 second address: A44360 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3070BEB5DAh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A4447C second address: A44483 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A44483 second address: A44489 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A44489 second address: A4449A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F30707E4B36h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A4449A second address: A4449E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A4496E second address: A44989 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F30707E4B45h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A43702 second address: A43708 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A43708 second address: A4370C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A4370C second address: A43725 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3070BEB5E5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A486A8 second address: A486B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A0F821 second address: A0F825 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A0F825 second address: A0F82F instructions: 0x00000000 rdtsc 0x00000002 jl 00007F30707E4B36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A0F82F second address: A0F878 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F3070BEB5DEh 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e clc 0x0000000f lea eax, dword ptr [ebp+1248A577h] 0x00000015 jmp 00007F3070BEB5E3h 0x0000001a nop 0x0000001b jmp 00007F3070BEB5E0h 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A0F878 second address: A0F887 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F30707E4B3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A0F887 second address: 9E93E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3070BEB5DBh 0x00000008 jmp 00007F3070BEB5E8h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 call 00007F3070BEB5DBh 0x00000016 mov dword ptr [ebp+1247B02Eh], esi 0x0000001c pop ecx 0x0000001d call dword ptr [ebp+122D341Eh] 0x00000023 push eax 0x00000024 push edx 0x00000025 push edi 0x00000026 jnc 00007F3070BEB5D6h 0x0000002c pop edi 0x0000002d push edi 0x0000002e push edx 0x0000002f pop edx 0x00000030 jmp 00007F3070BEB5E3h 0x00000035 pop edi 0x00000036 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A0F969 second address: A0F96D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A0FDE2 second address: A0FDE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A0FE8C second address: A0FE90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A0FE90 second address: A0FE94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A0FE94 second address: A0FE9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A1001F second address: A1006F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, esi 0x00000008 push 00000000h 0x0000000a push esi 0x0000000b call 00007F3070BEB5D8h 0x00000010 pop esi 0x00000011 mov dword ptr [esp+04h], esi 0x00000015 add dword ptr [esp+04h], 0000001Bh 0x0000001d inc esi 0x0000001e push esi 0x0000001f ret 0x00000020 pop esi 0x00000021 ret 0x00000022 nop 0x00000023 jmp 00007F3070BEB5E9h 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d jc 00007F3070BEB5D6h 0x00000033 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A1006F second address: A1008B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F30707E4B48h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A1008B second address: A10091 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A10091 second address: A10095 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A10147 second address: A10155 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop edi 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A10155 second address: A10198 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F30707E4B41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F30707E4B40h 0x0000000e popad 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 jp 00007F30707E4B3Eh 0x00000019 mov eax, dword ptr [eax] 0x0000001b jc 00007F30707E4B3Eh 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A10AFE second address: A10B04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A10B04 second address: A10B17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c ja 00007F30707E4B36h 0x00000012 popad 0x00000013 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A10B17 second address: 9E9F3C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F3070BEB5D6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e nop 0x0000000f xor cx, A4CCh 0x00000014 call dword ptr [ebp+122D18BAh] 0x0000001a jne 00007F3070BEB5FEh 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 push ebx 0x00000024 pop ebx 0x00000025 push ebx 0x00000026 pop ebx 0x00000027 push ecx 0x00000028 pop ecx 0x00000029 popad 0x0000002a rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A48980 second address: A489AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a jmp 00007F30707E4B49h 0x0000000f jg 00007F30707E4B36h 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 popad 0x00000018 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A4ECD5 second address: A4ECDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A4ECDB second address: A4ECE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 jg 00007F30707E4B36h 0x0000000c pop esi 0x0000000d rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A4E52F second address: A4E573 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3070BEB5DEh 0x00000009 jmp 00007F3070BEB5E6h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F3070BEB5E7h 0x00000018 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A51772 second address: A51776 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A51776 second address: A51785 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jl 00007F3070BEB5D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A51785 second address: A517A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F30707E4B36h 0x0000000a jmp 00007F30707E4B43h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A517A7 second address: A517B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F3070BEB5D6h 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A53ACC second address: A53ADE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007F30707E4B3Bh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 9BC879 second address: 9BC889 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007F3070BEB5D6h 0x00000010 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A536EC second address: A536F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A536F7 second address: A536FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A56A16 second address: A56A35 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F30707E4B45h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A56A35 second address: A56A39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A5648D second address: A5649F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b jc 00007F30707E4B36h 0x00000011 popad 0x00000012 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A56708 second address: A5670C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A5670C second address: A5672C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F30707E4B3Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F30707E4B3Dh 0x00000012 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A5672C second address: A56730 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A56730 second address: A56738 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A56738 second address: A5673E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A5673E second address: A56742 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A56742 second address: A56764 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3070BEB5DEh 0x00000007 jnc 00007F3070BEB5D6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jo 00007F3070BEB5D6h 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A5AA13 second address: A5AA32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F30707E4B36h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jmp 00007F30707E4B42h 0x00000012 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A5AA32 second address: A5AA37 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A5AB75 second address: A5AB79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A5AB79 second address: A5AB88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F3070BEB5D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A5AB88 second address: A5ABA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 ja 00007F30707E4B36h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F30707E4B3Bh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A5ABA4 second address: A5ABA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A5ABA8 second address: A5ABAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A5AD11 second address: A5AD19 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A5F777 second address: A5F77D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A5F77D second address: A5F781 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A5F781 second address: A5F7B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F30707E4B3Ah 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F30707E4B45h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 pushad 0x00000014 popad 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 popad 0x00000018 pushad 0x00000019 jng 00007F30707E4B36h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A10547 second address: A105CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3070BEB5E0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov ebx, dword ptr [ebp+1248A5B6h] 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 call 00007F3070BEB5D8h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], esi 0x0000001f add dword ptr [esp+04h], 00000019h 0x00000027 inc esi 0x00000028 push esi 0x00000029 ret 0x0000002a pop esi 0x0000002b ret 0x0000002c add eax, ebx 0x0000002e push 00000000h 0x00000030 push ebx 0x00000031 call 00007F3070BEB5D8h 0x00000036 pop ebx 0x00000037 mov dword ptr [esp+04h], ebx 0x0000003b add dword ptr [esp+04h], 00000015h 0x00000043 inc ebx 0x00000044 push ebx 0x00000045 ret 0x00000046 pop ebx 0x00000047 ret 0x00000048 sub dword ptr [ebp+124695F8h], eax 0x0000004e push eax 0x0000004f jl 00007F3070BEB5DAh 0x00000055 mov dword ptr [esp], eax 0x00000058 or dword ptr [ebp+122D2C16h], edx 0x0000005e push 00000004h 0x00000060 push edi 0x00000061 mov ch, D4h 0x00000063 pop edx 0x00000064 push eax 0x00000065 push ebx 0x00000066 push eax 0x00000067 push edx 0x00000068 jne 00007F3070BEB5D6h 0x0000006e rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A105CE second address: A105D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A60187 second address: A601B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3070BEB5E0h 0x00000009 jmp 00007F3070BEB5E7h 0x0000000e rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A601B2 second address: A601C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007F30707E4B36h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A601C4 second address: A601C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A60C8E second address: A60C97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A6475F second address: A64770 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3070BEB5DAh 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A64770 second address: A6477C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F30707E4B36h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A6477C second address: A64782 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A648E3 second address: A648E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A648E7 second address: A64912 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d jo 00007F3070BEB5D6h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F3070BEB5E5h 0x0000001b rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A64B72 second address: A64BAB instructions: 0x00000000 rdtsc 0x00000002 jns 00007F30707E4B3Ah 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jne 00007F30707E4B3Ch 0x00000011 pushad 0x00000012 push esi 0x00000013 pop esi 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 jmp 00007F30707E4B47h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A64BAB second address: A64BB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A64BB4 second address: A64BBA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A6AE88 second address: A6AE93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F3070BEB5D6h 0x0000000a pop ebx 0x0000000b rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A6AE93 second address: A6AEC0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F30707E4B44h 0x00000007 jmp 00007F30707E4B41h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A6B055 second address: A6B084 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F3070BEB5E9h 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F3070BEB5E2h 0x0000000f rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A6B344 second address: A6B348 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A6B61A second address: A6B634 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3070BEB5E6h 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A6B634 second address: A6B649 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F30707E4B3Dh 0x0000000d rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A6B649 second address: A6B660 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F3070BEB5E2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A6B9DD second address: A6B9E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A6BCE1 second address: A6BCEB instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3070BEB5DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A6BCEB second address: A6BCF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A6C51E second address: A6C522 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A6C522 second address: A6C526 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A768E8 second address: A768FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jbe 00007F3070BEB5D6h 0x0000000f jnc 00007F3070BEB5D6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A768FF second address: A76919 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jno 00007F30707E4B38h 0x0000000b popad 0x0000000c jl 00007F30707E4B50h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A75A21 second address: A75A27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A75B67 second address: A75B6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A75B6D second address: A75B95 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jnp 00007F3070BEB5D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F3070BEB5E9h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A76019 second address: A7601D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A761CE second address: A761D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A761D2 second address: A761D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A761D6 second address: A761DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A761DC second address: A761E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A765EE second address: A7660A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3070BEB5E8h 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A804FA second address: A8050B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jnc 00007F30707E4B36h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A8050B second address: A8050F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A8050F second address: A80523 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F30707E4B40h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A80523 second address: A8053B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3070BEB5E4h 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A8053B second address: A80549 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F30707E4B36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A80549 second address: A8054D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A8054D second address: A80591 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F30707E4B41h 0x00000007 jg 00007F30707E4B36h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F30707E4B43h 0x00000018 jmp 00007F30707E4B42h 0x0000001d rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A7EB14 second address: A7EB1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A7EF34 second address: A7EF38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A7EF38 second address: A7EF3E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A7EF3E second address: A7EF72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007F30707E4B47h 0x0000000c pop edx 0x0000000d pushad 0x0000000e jmp 00007F30707E4B3Eh 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A7F0CE second address: A7F0D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A7F0D3 second address: A7F0FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F30707E4B49h 0x00000009 jno 00007F30707E4B36h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A7F0FD second address: A7F107 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F3070BEB5D6h 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A7F107 second address: A7F10D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A7F3CF second address: A7F3D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A7FC72 second address: A7FC76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A803AF second address: A803B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A86C78 second address: A86C9D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F30707E4B49h 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007F30707E4B36h 0x00000011 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A86C9D second address: A86CA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A86DFC second address: A86E02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A9484E second address: A94852 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A98B8F second address: A98B9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F30707E4B3Ah 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A98B9D second address: A98BA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A9D2DD second address: A9D2E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A9D2E3 second address: A9D345 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3070BEB5E8h 0x0000000b pop ebx 0x0000000c pushad 0x0000000d jmp 00007F3070BEB5DEh 0x00000012 jmp 00007F3070BEB5E8h 0x00000017 push eax 0x00000018 push edx 0x00000019 jbe 00007F3070BEB5D6h 0x0000001f jmp 00007F3070BEB5E4h 0x00000024 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A9D345 second address: A9D34B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: A9D34B second address: A9D355 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: AA03AB second address: AA03C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F30707E4B45h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: AA03C8 second address: AA03CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: AA03CC second address: AA03FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 je 00007F30707E4B36h 0x0000000d js 00007F30707E4B36h 0x00000013 pop ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F30707E4B49h 0x0000001b push esi 0x0000001c pop esi 0x0000001d rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: AA6796 second address: AA679C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: AA679C second address: AA67A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: AA67A8 second address: AA67B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: AA67B1 second address: AA67B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: AAE1F6 second address: AAE212 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3070BEB5E8h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: AAE212 second address: AAE21B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: AAEADC second address: AAEAE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jo 00007F3070BEB5D6h 0x0000000c rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: AAEAE8 second address: AAEAF0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: AB0E2E second address: AB0E34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: AB0E34 second address: AB0E3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: AB0E3A second address: AB0E43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: AB0E43 second address: AB0E4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 ja 00007F30707E4B36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: AB41D0 second address: AB41E4 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F3070BEB5D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jng 00007F3070BEB5D6h 0x00000013 popad 0x00000014 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: AB41E4 second address: AB41F7 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F30707E4B3Eh 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: AB6339 second address: AB634E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3070BEB5DCh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: AB634E second address: AB6352 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: AD139B second address: AD13A1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: ACC560 second address: ACC564 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: ADF682 second address: ADF68C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: ADF68C second address: ADF690 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: ADF690 second address: ADF6D8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F3070BEB5E9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jl 00007F3070BEB5F6h 0x00000014 jmp 00007F3070BEB5E6h 0x00000019 jmp 00007F3070BEB5DAh 0x0000001e rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: ADF6D8 second address: ADF6DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: ADF6DE second address: ADF6E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: ADF4EC second address: ADF509 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F30707E4B48h 0x00000009 popad 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: ADF509 second address: ADF50E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: ADF50E second address: ADF519 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: AE2090 second address: AE20B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F3070BEB5E5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007F3070BEB5D6h 0x00000013 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: AE3949 second address: AE3972 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F30707E4B44h 0x0000000d jmp 00007F30707E4B3Dh 0x00000012 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: B250D7 second address: B250DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: B250DD second address: B250E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: B250E1 second address: B250F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 ja 00007F3070BEB5D6h 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: B250F3 second address: B250F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: B25278 second address: B25280 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: B25280 second address: B25285 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: B253F0 second address: B253F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: B25C33 second address: B25C52 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F30707E4B43h 0x00000011 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: B25C52 second address: B25C58 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: B2883B second address: B2885F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F30707E4B47h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: B2885F second address: B28863 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: B28A73 second address: B28A89 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F30707E4B3Ch 0x0000000f rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: B28A89 second address: B28A8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: B28A8F second address: B28B43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov dl, 2Eh 0x0000000b push 00000004h 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007F30707E4B38h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 00000017h 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 jmp 00007F30707E4B41h 0x0000002c call 00007F30707E4B39h 0x00000031 push ecx 0x00000032 jg 00007F30707E4B3Ch 0x00000038 pop ecx 0x00000039 push eax 0x0000003a pushad 0x0000003b push edi 0x0000003c jmp 00007F30707E4B45h 0x00000041 pop edi 0x00000042 jng 00007F30707E4B3Ch 0x00000048 jne 00007F30707E4B36h 0x0000004e popad 0x0000004f mov eax, dword ptr [esp+04h] 0x00000053 ja 00007F30707E4B53h 0x00000059 mov eax, dword ptr [eax] 0x0000005b push eax 0x0000005c push edx 0x0000005d jmp 00007F30707E4B3Fh 0x00000062 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: B28DC0 second address: B28E18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007F3070BEB5D8h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 00000019h 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 mov dword ptr [ebp+122D1EB2h], edi 0x00000028 push dword ptr [ebp+122D2A15h] 0x0000002e xor dword ptr [ebp+122D2B9Eh], esi 0x00000034 call 00007F3070BEB5D9h 0x00000039 jne 00007F3070BEB5DEh 0x0000003f push eax 0x00000040 pushad 0x00000041 push eax 0x00000042 push edx 0x00000043 push ebx 0x00000044 pop ebx 0x00000045 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: B28E18 second address: B28E35 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F30707E4B36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ebx 0x0000000e popad 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 push eax 0x00000014 push edx 0x00000015 push edx 0x00000016 ja 00007F30707E4B36h 0x0000001c pop edx 0x0000001d rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: B28E35 second address: B28E3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F3070BEB5D6h 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: B28E3F second address: B28E4F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: B2BC22 second address: B2BC26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51D010C second address: 51D0112 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51D0112 second address: 51D0116 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51D0116 second address: 51D011A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51D011A second address: 51D0165 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b pushad 0x0000000c mov ax, 8DA5h 0x00000010 pushfd 0x00000011 jmp 00007F3070BEB5E2h 0x00000016 or ax, 54B8h 0x0000001b jmp 00007F3070BEB5DBh 0x00000020 popfd 0x00000021 popad 0x00000022 popad 0x00000023 pop ebp 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F3070BEB5E0h 0x0000002d rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51D0165 second address: 51D0169 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51D0169 second address: 51D016F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B1CFB second address: 51B1D2D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, F5h 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b jmp 00007F30707E4B46h 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F30707E4B3Eh 0x00000018 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B1D2D second address: 51B1D3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3070BEB5DEh 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B1D3F second address: 51B1D65 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F30707E4B3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F30707E4B40h 0x00000015 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B1D65 second address: 51B1D74 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3070BEB5DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B1D74 second address: 51B1D7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B1D7A second address: 51B1D7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B1D7E second address: 51B1D82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B1E3C second address: 51B1E40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B1E40 second address: 51B1E53 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F30707E4B3Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B1E53 second address: 51B1E59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0045 second address: 51B004B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B004B second address: 51B007E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F3070BEB5DFh 0x0000000f mov eax, dword ptr fs:[00000030h] 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F3070BEB5E0h 0x0000001e rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B007E second address: 51B008D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F30707E4B3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B021B second address: 51B022A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3070BEB5DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B022A second address: 51B02CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F30707E4B3Fh 0x00000009 jmp 00007F30707E4B43h 0x0000000e popfd 0x0000000f mov dx, ax 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 xchg eax, edi 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F30707E4B40h 0x0000001d sbb eax, 6B498C38h 0x00000023 jmp 00007F30707E4B3Bh 0x00000028 popfd 0x00000029 movzx esi, dx 0x0000002c popad 0x0000002d push eax 0x0000002e pushad 0x0000002f pushfd 0x00000030 jmp 00007F30707E4B40h 0x00000035 xor esi, 4D3F8698h 0x0000003b jmp 00007F30707E4B3Bh 0x00000040 popfd 0x00000041 mov eax, 572FB44Fh 0x00000046 popad 0x00000047 xchg eax, edi 0x00000048 jmp 00007F30707E4B42h 0x0000004d call dword ptr [76880B60h] 0x00000053 mov eax, 7709E5E0h 0x00000058 ret 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d pushad 0x0000005e popad 0x0000005f rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B02CA second address: 51B02E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3070BEB5E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B02E7 second address: 51B02ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B02ED second address: 51B02FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push 00000044h 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B02FB second address: 51B0346 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F30707E4B41h 0x0000000a adc ecx, 4C2F2EF6h 0x00000010 jmp 00007F30707E4B41h 0x00000015 popfd 0x00000016 popad 0x00000017 popad 0x00000018 pop edi 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F30707E4B48h 0x00000020 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0346 second address: 51B0358 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3070BEB5DEh 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0358 second address: 51B03BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov dx, si 0x0000000d call 00007F30707E4B46h 0x00000012 pushfd 0x00000013 jmp 00007F30707E4B42h 0x00000018 add esi, 12942408h 0x0000001e jmp 00007F30707E4B3Bh 0x00000023 popfd 0x00000024 pop esi 0x00000025 popad 0x00000026 mov dword ptr [esp], edi 0x00000029 pushad 0x0000002a jmp 00007F30707E4B45h 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 popad 0x00000033 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B03BF second address: 51B040A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push dword ptr [eax] 0x00000009 jmp 00007F3070BEB5E6h 0x0000000e mov eax, dword ptr fs:[00000030h] 0x00000014 jmp 00007F3070BEB5E0h 0x00000019 push dword ptr [eax+18h] 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f call 00007F3070BEB5DDh 0x00000024 pop esi 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B040A second address: 51B040F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B040F second address: 51B0426 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3070BEB5E3h 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B045A second address: 51B04B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F30707E4B41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F30707E4B3Ch 0x00000012 and cl, 00000048h 0x00000015 jmp 00007F30707E4B3Bh 0x0000001a popfd 0x0000001b jmp 00007F30707E4B48h 0x00000020 popad 0x00000021 je 00007F30E1E63D37h 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B04B3 second address: 51B04B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B04B9 second address: 51B0579 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F30707E4B44h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub eax, eax 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F30707E4B47h 0x00000012 xor ax, 674Eh 0x00000017 jmp 00007F30707E4B49h 0x0000001c popfd 0x0000001d call 00007F30707E4B40h 0x00000022 pushfd 0x00000023 jmp 00007F30707E4B42h 0x00000028 or ax, 56F8h 0x0000002d jmp 00007F30707E4B3Bh 0x00000032 popfd 0x00000033 pop eax 0x00000034 popad 0x00000035 mov dword ptr [esi], edi 0x00000037 pushad 0x00000038 mov bl, 6Eh 0x0000003a mov al, 16h 0x0000003c popad 0x0000003d mov dword ptr [esi+04h], eax 0x00000040 pushad 0x00000041 push ebx 0x00000042 mov ch, 82h 0x00000044 pop ebx 0x00000045 mov ebx, eax 0x00000047 popad 0x00000048 mov dword ptr [esi+08h], eax 0x0000004b pushad 0x0000004c movzx eax, di 0x0000004f mov esi, ebx 0x00000051 popad 0x00000052 mov dword ptr [esi+0Ch], eax 0x00000055 push eax 0x00000056 push edx 0x00000057 jmp 00007F30707E4B46h 0x0000005c rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0579 second address: 51B057F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B057F second address: 51B0583 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0583 second address: 51B0587 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0587 second address: 51B0619 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebx+4Ch] 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F30707E4B3Fh 0x00000012 sub ecx, 1C1D7A2Eh 0x00000018 jmp 00007F30707E4B49h 0x0000001d popfd 0x0000001e pushfd 0x0000001f jmp 00007F30707E4B40h 0x00000024 or ch, FFFFFFA8h 0x00000027 jmp 00007F30707E4B3Bh 0x0000002c popfd 0x0000002d popad 0x0000002e mov dword ptr [esi+10h], eax 0x00000031 jmp 00007F30707E4B46h 0x00000036 mov eax, dword ptr [ebx+50h] 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007F30707E4B47h 0x00000040 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0619 second address: 51B0644 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, ax 0x00000006 call 00007F3070BEB5E0h 0x0000000b pop ecx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esi+14h], eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jmp 00007F3070BEB5DAh 0x0000001a popad 0x0000001b rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0644 second address: 51B065E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F30707E4B3Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+54h] 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B065E second address: 51B0662 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0757 second address: 51B078D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F30707E4B43h 0x0000000a adc cl, 0000005Eh 0x0000000d jmp 00007F30707E4B49h 0x00000012 popfd 0x00000013 popad 0x00000014 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B078D second address: 51B079D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3070BEB5DCh 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B079D second address: 51B07DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+2Ch], eax 0x0000000b jmp 00007F30707E4B47h 0x00000010 mov ax, word ptr [ebx+6Ch] 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F30707E4B45h 0x0000001b rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B07DA second address: 51B0809 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F3070BEB5E7h 0x00000008 pop eax 0x00000009 mov di, 255Ch 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov word ptr [esi+30h], ax 0x00000014 pushad 0x00000015 mov bh, C3h 0x00000017 push eax 0x00000018 push edx 0x00000019 mov cx, 52BFh 0x0000001d rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0809 second address: 51B082F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F30707E4B44h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov ax, word ptr [ebx+00000088h] 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B082F second address: 51B0835 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0835 second address: 51B0847 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov word ptr [esi+32h], ax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0847 second address: 51B084B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B084B second address: 51B084F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B084F second address: 51B0855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0855 second address: 51B087E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, 3B0B2B23h 0x00000008 mov ecx, 595B567Fh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [ebx+0000008Ch] 0x00000016 pushad 0x00000017 mov eax, 3EDF9677h 0x0000001c mov bx, cx 0x0000001f popad 0x00000020 mov dword ptr [esi+34h], eax 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B087E second address: 51B0882 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0882 second address: 51B0886 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0886 second address: 51B088C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B088C second address: 51B08DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F30707E4B3Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+18h] 0x0000000c pushad 0x0000000d jmp 00007F30707E4B3Eh 0x00000012 mov ch, 09h 0x00000014 popad 0x00000015 mov dword ptr [esi+38h], eax 0x00000018 pushad 0x00000019 mov dx, D65Eh 0x0000001d movsx ebx, si 0x00000020 popad 0x00000021 mov eax, dword ptr [ebx+1Ch] 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 pushfd 0x00000028 jmp 00007F30707E4B3Ah 0x0000002d adc eax, 5403E728h 0x00000033 jmp 00007F30707E4B3Bh 0x00000038 popfd 0x00000039 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B08DE second address: 51B08E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B08E2 second address: 51B092B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F30707E4B46h 0x0000000c and ax, 1988h 0x00000011 jmp 00007F30707E4B3Bh 0x00000016 popfd 0x00000017 popad 0x00000018 mov dword ptr [esi+3Ch], eax 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F30707E4B45h 0x00000022 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B092B second address: 51B094C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, ebx 0x00000005 movsx edx, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [ebx+20h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F3070BEB5E1h 0x00000015 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B094C second address: 51B0952 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0952 second address: 51B0956 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0956 second address: 51B095A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B095A second address: 51B0979 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+40h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F3070BEB5E2h 0x00000012 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0979 second address: 51B09EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F30707E4B3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebx+00000080h] 0x0000000f pushad 0x00000010 mov di, cx 0x00000013 mov bx, cx 0x00000016 popad 0x00000017 push 00000001h 0x00000019 pushad 0x0000001a mov ch, 3Ah 0x0000001c push ebx 0x0000001d jmp 00007F30707E4B40h 0x00000022 pop esi 0x00000023 popad 0x00000024 push ebp 0x00000025 jmp 00007F30707E4B3Eh 0x0000002a mov dword ptr [esp], eax 0x0000002d jmp 00007F30707E4B40h 0x00000032 lea eax, dword ptr [ebp-10h] 0x00000035 jmp 00007F30707E4B40h 0x0000003a nop 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e mov dl, B7h 0x00000040 popad 0x00000041 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B09EA second address: 51B09F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0A2E second address: 51B0A33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0A33 second address: 51B0A52 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3070BEB5E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0A52 second address: 51B0AC2 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F30707E4B3Ah 0x00000008 xor al, 00000018h 0x0000000b jmp 00007F30707E4B3Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushfd 0x00000014 jmp 00007F30707E4B48h 0x00000019 jmp 00007F30707E4B45h 0x0000001e popfd 0x0000001f popad 0x00000020 test edi, edi 0x00000022 jmp 00007F30707E4B3Eh 0x00000027 js 00007F30E1E63749h 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 mov ax, di 0x00000033 mov edx, 0D9DD41Ch 0x00000038 popad 0x00000039 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0AC2 second address: 51B0AC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0AC8 second address: 51B0B13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebp-0Ch] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F30707E4B45h 0x00000014 adc al, 00000026h 0x00000017 jmp 00007F30707E4B41h 0x0000001c popfd 0x0000001d call 00007F30707E4B40h 0x00000022 pop esi 0x00000023 popad 0x00000024 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0B13 second address: 51B0B19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0B19 second address: 51B0B37 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e call 00007F30707E4B3Bh 0x00000013 pop esi 0x00000014 movsx ebx, ax 0x00000017 popad 0x00000018 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0B37 second address: 51B0B8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3070BEB5DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebx+78h] 0x0000000c pushad 0x0000000d push eax 0x0000000e mov bh, 3Ah 0x00000010 pop eax 0x00000011 movsx edx, cx 0x00000014 popad 0x00000015 push 00000001h 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a jmp 00007F3070BEB5E1h 0x0000001f pushfd 0x00000020 jmp 00007F3070BEB5E0h 0x00000025 add ax, A1E8h 0x0000002a jmp 00007F3070BEB5DBh 0x0000002f popfd 0x00000030 popad 0x00000031 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0B8B second address: 51B0BC5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F30707E4B49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F30707E4B48h 0x00000013 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0BC5 second address: 51B0BD4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3070BEB5DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0BD4 second address: 51B0BEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F30707E4B44h 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0BEC second address: 51B0C14 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3070BEB5DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F3070BEB5E4h 0x00000013 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0C14 second address: 51B0C2F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F30707E4B3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov edi, 797412D6h 0x00000012 push edi 0x00000013 pop eax 0x00000014 popad 0x00000015 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0C2F second address: 51B0C8D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, ecx 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea eax, dword ptr [ebp-08h] 0x0000000b jmp 00007F3070BEB5E7h 0x00000010 nop 0x00000011 pushad 0x00000012 mov dx, cx 0x00000015 pushfd 0x00000016 jmp 00007F3070BEB5E0h 0x0000001b jmp 00007F3070BEB5E5h 0x00000020 popfd 0x00000021 popad 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F3070BEB5DCh 0x0000002a rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0CDD second address: 51B0CE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0CE3 second address: 51B0CF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3070BEB5DDh 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0CF4 second address: 51B0D97 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F30707E4B41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov edi, eax 0x0000000d jmp 00007F30707E4B3Eh 0x00000012 test edi, edi 0x00000014 jmp 00007F30707E4B40h 0x00000019 js 00007F30E1E634C2h 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007F30707E4B3Dh 0x00000026 jmp 00007F30707E4B3Bh 0x0000002b popfd 0x0000002c popad 0x0000002d mov eax, dword ptr [ebp-04h] 0x00000030 jmp 00007F30707E4B46h 0x00000035 mov dword ptr [esi+08h], eax 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b pushfd 0x0000003c jmp 00007F30707E4B3Dh 0x00000041 sub ah, 00000036h 0x00000044 jmp 00007F30707E4B41h 0x00000049 popfd 0x0000004a mov eax, 1CACB327h 0x0000004f popad 0x00000050 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0D97 second address: 51B0DB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3070BEB5E8h 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0DB3 second address: 51B0DB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0DB7 second address: 51B0DF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea eax, dword ptr [ebx+70h] 0x0000000b jmp 00007F3070BEB5E7h 0x00000010 push 00000001h 0x00000012 jmp 00007F3070BEB5E6h 0x00000017 nop 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0DF8 second address: 51B0E15 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F30707E4B49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0E15 second address: 51B0E30 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, 96h 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F3070BEB5E0h 0x00000010 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0E30 second address: 51B0EC2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 386D4184h 0x00000008 push edx 0x00000009 pop esi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e jmp 00007F30707E4B3Fh 0x00000013 lea eax, dword ptr [ebp-18h] 0x00000016 jmp 00007F30707E4B46h 0x0000001b nop 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007F30707E4B3Eh 0x00000023 or ecx, 0F714498h 0x00000029 jmp 00007F30707E4B3Bh 0x0000002e popfd 0x0000002f pushfd 0x00000030 jmp 00007F30707E4B48h 0x00000035 adc ch, FFFFFFF8h 0x00000038 jmp 00007F30707E4B3Bh 0x0000003d popfd 0x0000003e popad 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F30707E4B3Bh 0x00000049 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0EC2 second address: 51B0EC8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0F24 second address: 51B0F28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0F28 second address: 51B0F2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0F2C second address: 51B0F32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0F32 second address: 51B0F72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3070BEB5E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007F30E2269D3Bh 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushfd 0x00000013 jmp 00007F3070BEB5DCh 0x00000018 or ecx, 026EEFA8h 0x0000001e jmp 00007F3070BEB5DBh 0x00000023 popfd 0x00000024 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0F72 second address: 51B0F76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B0F76 second address: 51B105C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushfd 0x00000008 jmp 00007F3070BEB5E5h 0x0000000d add si, 1BC6h 0x00000012 jmp 00007F3070BEB5E1h 0x00000017 popfd 0x00000018 pop esi 0x00000019 popad 0x0000001a mov eax, dword ptr [ebp-14h] 0x0000001d jmp 00007F3070BEB5E7h 0x00000022 mov ecx, esi 0x00000024 jmp 00007F3070BEB5E6h 0x00000029 mov dword ptr [esi+0Ch], eax 0x0000002c pushad 0x0000002d mov edi, esi 0x0000002f mov cx, CD99h 0x00000033 popad 0x00000034 mov edx, 768B06ECh 0x00000039 jmp 00007F3070BEB5E4h 0x0000003e sub eax, eax 0x00000040 pushad 0x00000041 pushfd 0x00000042 jmp 00007F3070BEB5E7h 0x00000047 xor cl, 0000006Eh 0x0000004a jmp 00007F3070BEB5E9h 0x0000004f popfd 0x00000050 mov ebx, ecx 0x00000052 popad 0x00000053 lock cmpxchg dword ptr [edx], ecx 0x00000057 push eax 0x00000058 push edx 0x00000059 jmp 00007F3070BEB5E9h 0x0000005e rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B105C second address: 51B1062 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B1062 second address: 51B1066 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B1066 second address: 51B1086 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F30707E4B43h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B1086 second address: 51B108C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B108C second address: 51B10D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 4F8892AFh 0x00000008 pushfd 0x00000009 jmp 00007F30707E4B44h 0x0000000e and ax, 25D8h 0x00000013 jmp 00007F30707E4B3Bh 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c test eax, eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F30707E4B45h 0x00000025 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B10D6 second address: 51B10E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3070BEB5DCh 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B10E6 second address: 51B1103 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F30707E4B3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007F30E1E6311Bh 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B1103 second address: 51B1109 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B1109 second address: 51B1145 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F30707E4B3Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebp+08h] 0x0000000c jmp 00007F30707E4B40h 0x00000011 mov eax, dword ptr [esi] 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F30707E4B47h 0x0000001a rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B1145 second address: 51B114B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B114B second address: 51B114F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B114F second address: 51B11B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [edx], eax 0x0000000a jmp 00007F3070BEB5E7h 0x0000000f mov eax, dword ptr [esi+04h] 0x00000012 jmp 00007F3070BEB5E6h 0x00000017 mov dword ptr [edx+04h], eax 0x0000001a pushad 0x0000001b call 00007F3070BEB5DEh 0x00000020 pop ecx 0x00000021 pushad 0x00000022 mov cx, bx 0x00000025 mov ax, di 0x00000028 popad 0x00000029 popad 0x0000002a mov eax, dword ptr [esi+08h] 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007F3070BEB5DEh 0x00000034 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B11B8 second address: 51B11CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F30707E4B3Eh 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B11CA second address: 51B120F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3070BEB5DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [edx+08h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F3070BEB5DBh 0x00000017 sub eax, 31DCB2EEh 0x0000001d jmp 00007F3070BEB5E9h 0x00000022 popfd 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B120F second address: 51B1214 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B1214 second address: 51B1219 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B1219 second address: 51B12BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F30707E4B43h 0x0000000a jmp 00007F30707E4B43h 0x0000000f popfd 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 mov eax, dword ptr [esi+0Ch] 0x00000016 jmp 00007F30707E4B46h 0x0000001b mov dword ptr [edx+0Ch], eax 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007F30707E4B3Eh 0x00000025 or eax, 69FA7F28h 0x0000002b jmp 00007F30707E4B3Bh 0x00000030 popfd 0x00000031 call 00007F30707E4B48h 0x00000036 mov ah, 37h 0x00000038 pop edi 0x00000039 popad 0x0000003a mov eax, dword ptr [esi+10h] 0x0000003d pushad 0x0000003e mov ebx, esi 0x00000040 mov al, 13h 0x00000042 popad 0x00000043 mov dword ptr [edx+10h], eax 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007F30707E4B3Ah 0x0000004d rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B12BA second address: 51B12CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3070BEB5DEh 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B12CC second address: 51B1301 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esi+14h] 0x0000000b jmp 00007F30707E4B47h 0x00000010 mov dword ptr [edx+14h], eax 0x00000013 pushad 0x00000014 push ebx 0x00000015 mov al, A0h 0x00000017 pop edx 0x00000018 popad 0x00000019 mov eax, dword ptr [esi+18h] 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f mov dh, 13h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B1301 second address: 51B1306 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B1306 second address: 51B1352 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F30707E4B43h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+18h], eax 0x0000000c jmp 00007F30707E4B46h 0x00000011 mov eax, dword ptr [esi+1Ch] 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F30707E4B47h 0x0000001b rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B1352 second address: 51B1358 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B1358 second address: 51B139C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F30707E4B3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [edx+1Ch], eax 0x0000000e pushad 0x0000000f mov bx, si 0x00000012 mov edx, esi 0x00000014 popad 0x00000015 mov eax, dword ptr [esi+20h] 0x00000018 jmp 00007F30707E4B3Ah 0x0000001d mov dword ptr [edx+20h], eax 0x00000020 jmp 00007F30707E4B40h 0x00000025 mov eax, dword ptr [esi+24h] 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B139C second address: 51B13A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B13A0 second address: 51B13A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B13A6 second address: 51B13B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3070BEB5DBh 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B13B5 second address: 51B13B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B13B9 second address: 51B13DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [edx+24h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F3070BEB5E7h 0x00000014 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B13DF second address: 51B13FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F30707E4B49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B13FC second address: 51B1402 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B1402 second address: 51B1406 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B1406 second address: 51B1417 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esi+28h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B1417 second address: 51B141B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B141B second address: 51B141F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B141F second address: 51B1425 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B1425 second address: 51B142B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B142B second address: 51B142F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\random.exeRDTSC instruction interceptor: First address: 51B142F second address: 51B14C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [edx+28h], eax 0x0000000b pushad 0x0000000c jmp 00007F3070BEB5E7h 0x00000011 pushfd 0x00000012 jmp 00007F3070BEB5E8h 0x00000017 sbb cx, AE08h 0x0000001c jmp 00007F3070BEB5DBh 0x00000021 popfd 0x00000022 popad 0x00000023 mov ecx, dword ptr [esi+2Ch] 0x00000026 jmp 00007F3070BEB5E6h 0x0000002b mov dword ptr [edx+2Ch], ecx 0x0000002e jmp 00007F3070BEB5E0h 0x00000033 mov ax, word ptr [esi+30h] 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007F3070BEB5E7h 0x0000003e rdtsc
                    Source: C:\Users\user\Desktop\random.exeSpecial instruction interceptor: First address: 858974 instructions caused by: Self-modifying code
                    Source: C:\Users\user\Desktop\random.exeSpecial instruction interceptor: First address: 858A5D instructions caused by: Self-modifying code
                    Source: C:\Users\user\Desktop\random.exeSpecial instruction interceptor: First address: A24EC7 instructions caused by: Self-modifying code
                    Source: C:\Users\user\Desktop\random.exeSpecial instruction interceptor: First address: A0F9B4 instructions caused by: Self-modifying code
                    Source: C:\Users\user\Desktop\random.exeSpecial instruction interceptor: First address: A89618 instructions caused by: Self-modifying code
                    Source: C:\Users\user\Desktop\random.exeRegistry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDescJump to behavior
                    Source: C:\Users\user\Desktop\random.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersionJump to behavior
                    Source: C:\Users\user\Desktop\random.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersionJump to behavior
                    Source: C:\Users\user\Desktop\random.exeCode function: 1_2_05200E9A rdtsc 1_2_05200E9A
                    Source: C:\Users\user\Desktop\random.exe TID: 1516Thread sleep time: -30015s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\random.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : Select Name from Win32_Processor
                    Source: C:\Users\user\AppData\Local\Temp\svchost015.exeLast function: Thread delayed
                    Source: random.exe, random.exe, 00000001.00000002.1642900631.00000000009DA000.00000040.00000001.01000000.00000004.sdmpBinary or memory string: HARDWARE\ACPI\DSDT\VBOX__
                    Source: random.exe, random.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 00000003.00000000.1599518700.0000000000401000.00000020.00000001.01000000.00000006.sdmp, svchost015.exe.1.drBinary or memory string: ParallelsVirtualMachine
                    Source: random.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 00000003.00000000.1599518700.0000000000401000.00000020.00000001.01000000.00000006.sdmp, svchost015.exe.1.drBinary or memory string: xmlphpvlczpl wpl xpacketimport hrefXML:NAMESPACEaid DOCTYPE ELEMENT ENTITY -- <mdb:mork:zAFDR aom saved from url=(-->xmlns=jobwmlRDFnzbsvgkmlgpxCaRxslJDFrssRSStagTAGXMIlmxloclogIMGtmxosmX3DVERCFLRCCncxxbkSCFrtcpseSDOmapnviofcasxdivLogopmlsmilrootpgmlxfdfXFDLBASEtei2xbeljnlpdgmlfeedFEEDinfobeancasevxmlsesxnotesitetasklinkxbrlGAEBXZFXFormqgisSMAIHDMLjsonpsplbodyheadmetadictdocuembedplistTEI.2xliffformsQBXMLTypeseaglehtml5myapptablestyleentrygroupLXFMLwindowdialogSchemaschemacommonCanvaslayoutobjectFFDataReporttaglibARCXMLgnc-v2modulerobloxXDFV:4Xara3DLayoutRDCManattachwidgetreportSchemewebbuyloaderdeviceRDF:RDFweb:RDFoverlayprojectProjectabiwordxdp:xdpsvg:svgCOLLADASOFTPKGfo:rootlm:lmxarchivecollagelibraryHelpTOCpackagesiteMapen-noteFoundryweblinkReportssharingWebPartTestRunpopularsnippetwhpropsQBWCXMLcontentkml:kmlSDOListkDRouteFormSetactionslookupssectionns2:gpxPaletteCatalogProfileTreePadMIFFileKeyFilepayloadPresetsstringsdocumentDocumentNETSCAPEmetalinkresourcenewsItemhtmlplusEnvelopeplandatamoleculelicensesDatabasebindingsWorkbookPlaylistBookFileTimeLinejsp:rootbrowsersfotobookMTSScenemessengercomponentc:contactr:licensex:xmpmetadiscoveryERDiagramWorksheetcrickgridHelpIndexWinampXMLrecoIndexTomTomTocen-exportAnswerSetwinzipjobmuseScorePHONEBOOKm:myListsedmx:EdmxYNABData1workspacePlacemarkMakerFileoor:itemsscriptletcolorBookSignaturexsd:schemadlg:windowFinalDraftVirtualBoxTfrxReportVSTemplateWhiteboardstylesheetBurnWizarddictionaryPCSettingsRedlineXMLBackupMetaxbrli:xbrlFontFamilys:WorkbookFictionBookdia:diagramdefinitionsNmfDocumentSnippetRootSEC:SECMetanet:NetfileCustSectionDieCutLabelPremierDataUserControljsp:includess:Workbookapplicationjsp:useBeancfcomponentparticipantSessionFilejasperReporthelpdocumentxsl:documentxsl:templatePremiereDataSettingsFileCodeSnippetsFileInstancetpmOwnerDataDataTemplateProject_DataTfrReportBSAnote:notepadFieldCatalogUserSettingsgnm:WorkbookLIBRARY_ITEMDocumentDatamso:customUIpicasa2albumrnpddatabasepdfpreflightrn-customizecml:moleculemuveeProjectRelationshipsVisioDocumentxsl:transformD:multistatusKMYMONEY-FILEBackupCatalogfile:ManifestPocketMindMapDiagramLayoutannotationSetLEAPTOFROGANSpublic:attachsoap:EnvelopepersistedQuerymx:ApplicationOverDriveMediaasmv1:assemblyHelpCollectionQvdTableHeaderSCRIBUSUTF8NEWw:wordDocumentPADocumentRootConfigMetadataBorlandProjectDTS:ExecutableMMC_ConsoleFilelibrary:libraryglade-interfacerg:licenseGroupdisco:discoveryAdobeSwatchbookaudacityprojectoffice:documentCoolpixTransfersqueeze_projectwirelessProfileProjectFileInfowsdl:definitionsScrivenerProjectfulfillmentTokenkey:presentationdynamicDiscoverylibrary:librariesClickToDvdProjectDataCladFileStorechat_api_responseMyApplicationDataKeyboardShortcutsDeepBurner_recordXmlTransformationdata.vos.BudgetVOIRIDASCompositionpresentationClipsoor:component-datalibraryDescriptionPowerShellMetadataResourceDictionaryxsf:xDocumentClassoffice:color-tableVisualStudioProjectActiveReportsLayoutwap-provisioningdocAfterEffectsProjectoor:component-sch
                    Source: random.exe, 00000001.00000003.1312934026.0000000004CA0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: QEMUU
                    Source: svchost015.exe, 00000003.00000002.2554279889.00000000006C8000.00000004.00000020.00020000.00000000.sdmp, svchost015.exe, 00000003.00000002.2554279889.000000000067F000.00000004.00000020.00020000.00000000.sdmp, svchost015.exe, 00000003.00000002.2554279889.00000000006AC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                    Source: random.exe, 00000001.00000002.1642900631.00000000009DA000.00000040.00000001.01000000.00000004.sdmpBinary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
                    Source: random.exe, 00000001.00000003.1603645559.0000000000F67000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                    Source: C:\Users\user\Desktop\random.exeSystem information queried: ModuleInformationJump to behavior
                    Source: C:\Users\user\Desktop\random.exeProcess information queried: ProcessInformationJump to behavior

                    Anti Debugging

                    barindex
                    Source: C:\Users\user\Desktop\random.exeThread information set: HideFromDebuggerJump to behavior
                    Source: C:\Users\user\Desktop\random.exeCode function: 1_2_0526066E Start: 05260752 End: 052606981_2_0526066E
                    Source: C:\Users\user\Desktop\random.exeCode function: 1_2_052609FB Start: 05260BDC End: 05260A301_2_052609FB
                    Source: C:\Users\user\Desktop\random.exeCode function: 1_2_05300178 Start: 053007E0 End: 053001AC1_2_05300178
                    Source: C:\Users\user\Desktop\random.exeOpen window title or class name: regmonclass
                    Source: C:\Users\user\Desktop\random.exeOpen window title or class name: gbdyllo
                    Source: C:\Users\user\Desktop\random.exeOpen window title or class name: process monitor - sysinternals: www.sysinternals.com
                    Source: C:\Users\user\Desktop\random.exeOpen window title or class name: procmon_window_class
                    Source: C:\Users\user\Desktop\random.exeOpen window title or class name: registry monitor - sysinternals: www.sysinternals.com
                    Source: C:\Users\user\Desktop\random.exeOpen window title or class name: ollydbg
                    Source: C:\Users\user\Desktop\random.exeOpen window title or class name: filemonclass
                    Source: C:\Users\user\Desktop\random.exeOpen window title or class name: file monitor - sysinternals: www.sysinternals.com
                    Source: C:\Users\user\Desktop\random.exeFile opened: NTICE
                    Source: C:\Users\user\Desktop\random.exeFile opened: SICE
                    Source: C:\Users\user\Desktop\random.exeFile opened: SIWVID
                    Source: C:\Users\user\Desktop\random.exeProcess queried: DebugPortJump to behavior
                    Source: C:\Users\user\Desktop\random.exeProcess queried: DebugPortJump to behavior
                    Source: C:\Users\user\Desktop\random.exeProcess queried: DebugPortJump to behavior
                    Source: C:\Users\user\Desktop\random.exeCode function: 1_2_05200E9A rdtsc 1_2_05200E9A

                    HIPS / PFW / Operating System Protection Evasion

                    barindex
                    Source: C:\Users\user\Desktop\random.exeMemory allocated: C:\Users\user\AppData\Local\Temp\svchost015.exe base: 400000 protect: page execute and read and writeJump to behavior
                    Source: C:\Users\user\Desktop\random.exeMemory written: C:\Users\user\AppData\Local\Temp\svchost015.exe base: 400000 value starts with: 4D5AJump to behavior
                    Source: C:\Users\user\Desktop\random.exeSection unmapped: C:\Users\user\AppData\Local\Temp\svchost015.exe base address: 400000Jump to behavior
                    Source: C:\Users\user\Desktop\random.exeMemory written: C:\Users\user\AppData\Local\Temp\svchost015.exe base: 400000Jump to behavior
                    Source: C:\Users\user\Desktop\random.exeMemory written: C:\Users\user\AppData\Local\Temp\svchost015.exe base: 401000Jump to behavior
                    Source: C:\Users\user\Desktop\random.exeMemory written: C:\Users\user\AppData\Local\Temp\svchost015.exe base: 41D000Jump to behavior
                    Source: C:\Users\user\Desktop\random.exeMemory written: C:\Users\user\AppData\Local\Temp\svchost015.exe base: 42A000Jump to behavior
                    Source: C:\Users\user\Desktop\random.exeMemory written: C:\Users\user\AppData\Local\Temp\svchost015.exe base: 42C000Jump to behavior
                    Source: C:\Users\user\Desktop\random.exeMemory written: C:\Users\user\AppData\Local\Temp\svchost015.exe base: 42D000Jump to behavior
                    Source: C:\Users\user\Desktop\random.exeProcess created: C:\Users\user\AppData\Local\Temp\svchost015.exe "C:\Users\user\Desktop\random.exe"Jump to behavior
                    Source: random.exe, random.exe, 00000001.00000002.1642900631.00000000009DA000.00000040.00000001.01000000.00000004.sdmpBinary or memory string: ;Program Manager

                    Stealing of Sensitive Information

                    barindex
                    Source: Yara matchFile source: 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

                    Remote Access Functionality

                    barindex
                    Source: Yara matchFile source: 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                    Gather Victim Identity InformationAcquire InfrastructureValid Accounts11
                    Windows Management Instrumentation
                    1
                    DLL Side-Loading
                    412
                    Process Injection
                    1
                    Masquerading
                    OS Credential Dumping651
                    Security Software Discovery
                    Remote Services1
                    Archive Collected Data
                    11
                    Encrypted Channel
                    Exfiltration Over Other Network MediumAbuse Accessibility Features
                    CredentialsDomainsDefault Accounts2
                    Command and Scripting Interpreter
                    Boot or Logon Initialization Scripts1
                    DLL Side-Loading
                    25
                    Virtualization/Sandbox Evasion
                    LSASS Memory25
                    Virtualization/Sandbox Evasion
                    Remote Desktop ProtocolData from Removable Media1
                    Ingress Tool Transfer
                    Exfiltration Over BluetoothNetwork Denial of Service
                    Email AddressesDNS ServerDomain Accounts1
                    Shared Modules
                    Logon Script (Windows)Logon Script (Windows)412
                    Process Injection
                    Security Account Manager2
                    Process Discovery
                    SMB/Windows Admin SharesData from Network Shared Drive2
                    Non-Application Layer Protocol
                    Automated ExfiltrationData Encrypted for Impact
                    Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook2
                    Obfuscated Files or Information
                    NTDS23
                    System Information Discovery
                    Distributed Component Object ModelInput Capture3
                    Application Layer Protocol
                    Traffic DuplicationData Destruction
                    Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script12
                    Software Packing
                    LSA SecretsInternet Connection DiscoverySSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                    Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
                    DLL Side-Loading
                    Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                    Hide Legend

                    Legend:

                    • Process
                    • Signature
                    • Created File
                    • DNS/IP Info
                    • Is Dropped
                    • Is Windows Process
                    • Number of created Registry Values
                    • Number of created Files
                    • Visual Basic
                    • Delphi
                    • Java
                    • .Net C# or VB.NET
                    • C, C++ or other language
                    • Is malicious
                    • Internet
                    behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1675412 Sample: random.exe Startdate: 27/04/2025 Architecture: WINDOWS Score: 100 16 drive.usercontent.google.com 2->16 22 Multi AV Scanner detection for submitted file 2->22 24 Yara detected CryptOne packer 2->24 26 PE file contains section with special chars 2->26 28 Joe Sandbox ML detected suspicious sample 2->28 7 random.exe 1 2->7         started        signatures3 process4 file5 14 C:\Users\user\AppData\...\svchost015.exe, PE32 7->14 dropped 30 Detected unpacking (changes PE section rights) 7->30 32 Tries to detect sandboxes and other dynamic analysis tools (window names) 7->32 34 Writes to foreign memory regions 7->34 36 9 other signatures 7->36 11 svchost015.exe 13 7->11         started        signatures6 process7 dnsIp8 18 185.156.72.196, 80 ITDELUXE-ASRU Russian Federation 11->18 20 drive.usercontent.google.com 142.250.68.225, 443, 49695 GOOGLEUS United States 11->20

                    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                    windows-stand
                    SourceDetectionScannerLabelLink
                    random.exe28%VirustotalBrowse
                    random.exe44%ReversingLabsWin32.Malware.Heuristic
                    SAMPLE100%Joe Sandbox ML
                    SourceDetectionScannerLabelLink
                    C:\Users\user\AppData\Local\Temp\svchost015.exe4%ReversingLabs
                    No Antivirus matches
                    No Antivirus matches
                    SourceDetectionScannerLabelLink
                    http://185.156.72.196/ws0%Avira URL Cloudsafe
                    http://185.156.72.196/success?substr=mixsix&s=three&sub=none0%Avira URL Cloudsafe
                    http://185.156.72.196/success?substr=mixsix&s=three&sub=nonendOIDInfo0%Avira URL Cloudsafe
                    http://185.156.72.196/success?substr=mixsix&s=three&sub=none0.1S0%Avira URL Cloudsafe
                    http://www.borland.com/namespaces/Types-IAppServerSOAP0%Avira URL Cloudsafe
                    http://www.borland.com/namespaces/Typeslhttp://www.borland.com/namespaces/Types-IAppServerSOAPU0%Avira URL Cloudsafe
                    http://185.156.72.196/success?substr=mixsix&s=three&sub=noneE0%Avira URL Cloudsafe
                    http://185.156.72.196/success?substr=mixsix&s=three&sub=nonek0%Avira URL Cloudsafe
                    http://185.156.72.196/success?substr=mixsix&s=three&sub=nonec0%Avira URL Cloudsafe
                    http://185.156.72.196/success?substr=mixsix&s=three&sub=none0.10%Avira URL Cloudsafe
                    http://185.156.72.196/0%Avira URL Cloudsafe
                    http://185.156.72.196/success?substr=mixsix&s=three&sub=noneRYPT32.dll.muit_0%Avira URL Cloudsafe
                    http://185.156.72.196/success?substr=mixsix&s=three&sub=nonertificates0%Avira URL Cloudsafe
                    http://185.156.72.196/success?substr=mixsix&s=three&sub=noner0%Avira URL Cloudsafe
                    http://185.156.72.196/three&sub=noneemp0%Avira URL Cloudsafe

                    Download Network PCAP: filteredfull

                    NameIPActiveMaliciousAntivirus DetectionReputation
                    drive.usercontent.google.com
                    142.250.68.225
                    truefalse
                      high
                      NameSourceMaliciousAntivirus DetectionReputation
                      http://185.156.72.196/success?substr=mixsix&s=three&sub=nonendOIDInfosvchost015.exe, 00000003.00000002.2554279889.00000000006AC000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      unknown
                      http://185.156.72.196/wssvchost015.exe, 00000003.00000002.2554279889.00000000006AC000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      unknown
                      https://www.x-ways.net/forensics/x-tensions.htmlrandom.exe, random.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 00000003.00000000.1599518700.0000000000401000.00000020.00000001.01000000.00000006.sdmp, svchost015.exe.1.drfalse
                        high
                        https://www.x-ways.net/winhex/forum/www.x-ways.net/winhex/templates/www.x-ways.net/dongle_protectionrandom.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 00000003.00000000.1599518700.0000000000401000.00000020.00000001.01000000.00000006.sdmp, svchost015.exe.1.drfalse
                          high
                          http://185.156.72.196/success?substr=mixsix&s=three&sub=noneEsvchost015.exe, 00000003.00000002.2554279889.00000000006AC000.00000004.00000020.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          unknown
                          https://sectigo.com/CPS0random.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe.1.drfalse
                            high
                            http://cert.ssl.com/SSLcom-SubCA-CodeSigning-RSA-4096-R1.cer0Qrandom.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe.1.drfalse
                              high
                              http://schemas.xmlsoap.org/soap/encoding/Nhttp://www.borland.com/namespaces/Typesrandom.exe, 00000001.00000003.1312934026.0000000004CA0000.00000004.00001000.00020000.00000000.sdmpfalse
                                high
                                http://ocsp.sectigo.com0random.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe.1.drfalse
                                  high
                                  http://www.x-ways.net/winhex/subscriberandom.exe, random.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 00000003.00000000.1599518700.0000000000401000.00000020.00000001.01000000.00000006.sdmp, svchost015.exe.1.drfalse
                                    high
                                    http://schemas.xmlsoap.org/soap/encoding/random.exe, 00000001.00000002.1644178211.0000000000F2E000.00000004.00000020.00020000.00000000.sdmpfalse
                                      high
                                      http://www.borland.com/namespaces/Typeslhttp://www.borland.com/namespaces/Types-IAppServerSOAPUrandom.exe, 00000001.00000003.1312934026.0000000004CA0000.00000004.00001000.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      unknown
                                      https://www.x-ways.net/forensics/x-tensions.htmlfrandom.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 00000003.00000000.1599518700.0000000000401000.00000020.00000001.01000000.00000006.sdmp, svchost015.exe.1.drfalse
                                        high
                                        http://185.156.72.196/success?substr=mixsix&s=three&sub=none0.1Ssvchost015.exe, 00000003.00000002.2554975818.0000000002DA0000.00000004.00000020.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        unknown
                                        http://ocsps.ssl.com0random.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe.1.drfalse
                                          high
                                          https://drive.usercontent.google.com/svchost015.exe, 00000003.00000002.2554279889.00000000006AC000.00000004.00000020.00020000.00000000.sdmpfalse
                                            high
                                            https://github.com/tesseract-ocr/tessdata/random.exe, random.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 00000003.00000000.1599518700.0000000000401000.00000020.00000001.01000000.00000006.sdmp, svchost015.exe.1.drfalse
                                              high
                                              http://www.x-ways.net/winhex/subscribe-d.htmlUrandom.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 00000003.00000000.1599518700.0000000000401000.00000020.00000001.01000000.00000006.sdmp, svchost015.exe.1.drfalse
                                                high
                                                http://185.156.72.196/success?substr=mixsix&s=three&sub=nonesvchost015.exe, 00000003.00000002.2554975818.0000000002DA0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                unknown
                                                http://www.x-ways.net/orderrandom.exe, random.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 00000003.00000000.1599518700.0000000000401000.00000020.00000001.01000000.00000006.sdmp, svchost015.exe.1.drfalse
                                                  high
                                                  http://185.156.72.196/success?substr=mixsix&s=three&sub=none0.1svchost015.exe, 00000003.00000002.2554975818.0000000002DA0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0trandom.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe.1.drfalse
                                                    high
                                                    http://185.156.72.196/success?substr=mixsix&s=three&sub=noneksvchost015.exe, 00000003.00000002.2554279889.00000000006AC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    unknown
                                                    http://www.borland.com/namespaces/Types-IAppServerSOAPrandom.exe, 00000001.00000002.1648396081.0000000005460000.00000004.00001000.00020000.00000000.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    unknown
                                                    http://crls.ssl.com/ssl.com-rsa-RootCA.crl0random.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe.1.drfalse
                                                      high
                                                      http://www.borland.com/namespaces/Typesrandom.exe, 00000001.00000002.1644178211.0000000000F2E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        high
                                                        http://www.x-ways.net/order.html-d.htmlSrandom.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 00000003.00000000.1599518700.0000000000401000.00000020.00000001.01000000.00000006.sdmp, svchost015.exe.1.drfalse
                                                          high
                                                          http://185.156.72.196/success?substr=mixsix&s=three&sub=nonecsvchost015.exe, 00000003.00000002.2554975818.0000000002DA0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          unknown
                                                          http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#random.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe.1.drfalse
                                                            high
                                                            https://www.ssl.com/repository0random.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe.1.drfalse
                                                              high
                                                              https://www.x-ways.net/winhex/forum/random.exe, random.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 00000003.00000000.1599518700.0000000000401000.00000020.00000001.01000000.00000006.sdmp, svchost015.exe.1.drfalse
                                                                high
                                                                http://185.156.72.196/success?substr=mixsix&s=three&sub=noneRYPT32.dll.muit_svchost015.exe, 00000003.00000002.2554279889.00000000006AC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                • Avira URL Cloud: safe
                                                                unknown
                                                                http://www.x-ways.net/winhex/license-d-f.htmlSrandom.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 00000003.00000000.1599518700.0000000000401000.00000020.00000001.01000000.00000006.sdmp, svchost015.exe.1.drfalse
                                                                  high
                                                                  http://185.156.72.196/svchost015.exe, 00000003.00000002.2554279889.00000000006AC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  • Avira URL Cloud: safe
                                                                  unknown
                                                                  http://185.156.72.196/success?substr=mixsix&s=three&sub=nonersvchost015.exe, 00000003.00000002.2554975818.0000000002DA0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  • Avira URL Cloud: safe
                                                                  unknown
                                                                  http://crls.ssl.com/SSLcom-SubCA-CodeSigning-RSA-4096-R1.crl0random.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe.1.drfalse
                                                                    high
                                                                    http://www.x-ways.net/winhex/licenserandom.exe, random.exe, 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 00000003.00000000.1599518700.0000000000401000.00000020.00000001.01000000.00000006.sdmp, svchost015.exe.1.drfalse
                                                                      high
                                                                      http://185.156.72.196/three&sub=noneempsvchost015.exe, 00000003.00000002.2554279889.00000000006AC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      • Avira URL Cloud: safe
                                                                      unknown
                                                                      http://185.156.72.196/success?substr=mixsix&s=three&sub=nonertificatessvchost015.exe, 00000003.00000002.2554279889.00000000006AC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      • Avira URL Cloud: safe
                                                                      unknown
                                                                      • No. of IPs < 25%
                                                                      • 25% < No. of IPs < 50%
                                                                      • 50% < No. of IPs < 75%
                                                                      • 75% < No. of IPs
                                                                      IPDomainCountryFlagASNASN NameMalicious
                                                                      185.156.72.196
                                                                      unknownRussian Federation
                                                                      44636ITDELUXE-ASRUfalse
                                                                      142.250.68.225
                                                                      drive.usercontent.google.comUnited States
                                                                      15169GOOGLEUSfalse
                                                                      Joe Sandbox version:42.0.0 Malachite
                                                                      Analysis ID:1675412
                                                                      Start date and time:2025-04-27 10:06:03 +02:00
                                                                      Joe Sandbox product:CloudBasic
                                                                      Overall analysis duration:0h 4m 57s
                                                                      Hypervisor based Inspection enabled:false
                                                                      Report type:full
                                                                      Cookbook file name:default.jbs
                                                                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                      Number of analysed new started processes analysed:7
                                                                      Number of new started drivers analysed:0
                                                                      Number of existing processes analysed:0
                                                                      Number of existing drivers analysed:0
                                                                      Number of injected processes analysed:0
                                                                      Technologies:
                                                                      • HCA enabled
                                                                      • EGA enabled
                                                                      • AMSI enabled
                                                                      Analysis Mode:default
                                                                      Analysis stop reason:Timeout
                                                                      Sample name:random.exe
                                                                      Detection:MAL
                                                                      Classification:mal100.troj.evad.winEXE@3/2@1/2
                                                                      EGA Information:Failed
                                                                      HCA Information:Failed
                                                                      Cookbook Comments:
                                                                      • Found application associated with file extension: .exe
                                                                      • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                                                                      • Excluded IPs from analysis (whitelisted): 184.29.183.29, 20.12.23.50, 150.171.27.254
                                                                      • Excluded domains from analysis (whitelisted): c2a9c95e369881c67228a6591cac2686.clo.footprintdns.com, ax-ring.msedge.net, fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e16604.dscf.akamaiedge.net, c.pki.goog, fe3cr.delivery.mp.microsoft.com
                                                                      • Execution Graph export aborted for target random.exe, PID 7704 because it is empty
                                                                      • Not all processes where analyzed, report is missing behavior information
                                                                      • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                      • Report size getting too big, too many NtQueryValueKey calls found.
                                                                      No simulations
                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                      185.156.72.196random.exeGet hashmaliciousCryptOneBrowse
                                                                        random.exeGet hashmaliciousCryptOneBrowse
                                                                          random.exeGet hashmaliciousCryptOneBrowse
                                                                            No context
                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                            ITDELUXE-ASRUrandom.exeGet hashmaliciousCryptOneBrowse
                                                                            • 185.156.72.196
                                                                            random.exeGet hashmaliciousCryptOneBrowse
                                                                            • 185.156.72.196
                                                                            random.exeGet hashmaliciousCryptOneBrowse
                                                                            • 185.156.72.196
                                                                            ETVk1yP43q.exeGet hashmaliciousAZORultBrowse
                                                                            • 92.63.192.63
                                                                            file.exeGet hashmaliciousNymaimBrowse
                                                                            • 185.156.72.65
                                                                            file.exeGet hashmaliciousAmadey, Cryptbot, LummaC Stealer, Nymaim, StealcBrowse
                                                                            • 185.156.72.65
                                                                            file.exeGet hashmaliciousNymaimBrowse
                                                                            • 185.156.72.65
                                                                            file.exeGet hashmaliciousNymaimBrowse
                                                                            • 185.156.72.65
                                                                            file.exeGet hashmaliciousNymaimBrowse
                                                                            • 185.156.72.65
                                                                            file.exeGet hashmaliciousNymaimBrowse
                                                                            • 185.156.72.65
                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                            37f463bf4616ecd445d4a1937da06e19random.exeGet hashmaliciousAmadey, LummaC Stealer, Quasar, RedLine, Vidar, XmrigBrowse
                                                                            • 142.250.68.225
                                                                            random.exeGet hashmaliciousCryptOneBrowse
                                                                            • 142.250.68.225
                                                                            random.exeGet hashmaliciousCryptOneBrowse
                                                                            • 142.250.68.225
                                                                            random.exeGet hashmaliciousCryptOneBrowse
                                                                            • 142.250.68.225
                                                                            Ro4bYKEVnD.exeGet hashmaliciousUnknownBrowse
                                                                            • 142.250.68.225
                                                                            WA72.85107.1.exeGet hashmaliciousUnknownBrowse
                                                                            • 142.250.68.225
                                                                            DeltaV3.61.exeGet hashmaliciousXWormBrowse
                                                                            • 142.250.68.225
                                                                            RFQ#84839PRODUCT_SAMPLES_INQUIRY.exeGet hashmaliciousDiscord Token StealerBrowse
                                                                            • 142.250.68.225
                                                                            file.exeGet hashmaliciousVidarBrowse
                                                                            • 142.250.68.225
                                                                            Liberiansk.exeGet hashmaliciousGuLoaderBrowse
                                                                            • 142.250.68.225
                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                            C:\Users\user\AppData\Local\Temp\svchost015.exerandom.exeGet hashmaliciousCryptOneBrowse
                                                                              random.exeGet hashmaliciousCryptOneBrowse
                                                                                random.exeGet hashmaliciousCryptOneBrowse
                                                                                  random.exeGet hashmaliciousCryptOneBrowse
                                                                                    random.exeGet hashmaliciousCryptOneBrowse
                                                                                      random.exeGet hashmaliciousCryptOneBrowse
                                                                                        random.exeGet hashmaliciousCryptOneBrowse
                                                                                          random.exeGet hashmaliciousCryptOneBrowse
                                                                                            random.exeGet hashmaliciousAmadey, CryptOne, LummaC StealerBrowse
                                                                                              random.exeGet hashmaliciousCryptOneBrowse
                                                                                                Process:C:\Users\user\AppData\Local\Temp\svchost015.exe
                                                                                                File Type:ASCII text, with no line terminators
                                                                                                Category:dropped
                                                                                                Size (bytes):14
                                                                                                Entropy (8bit):2.8423709931771084
                                                                                                Encrypted:false
                                                                                                SSDEEP:3:pukmuEu:pu8Z
                                                                                                MD5:5E847B1CC501E8A09997640FED7DB52F
                                                                                                SHA1:3521F1FFA746C3B9C286C0B971121E1C5972C34B
                                                                                                SHA-256:C06903CB5A25E63794907092B488A8580074C872272A9FC51CEF5E76EEECF7A2
                                                                                                SHA-512:34DF35C7AB111DE0987409E72CA4473C7A3BAB84EB1A507424EDC6BC9B2570DD3889B668AD8F1252470DCC962739A1B5D39F40A83FCD45C953DB4F5AC8319845
                                                                                                Malicious:false
                                                                                                Reputation:low
                                                                                                Preview:AHEKAEFKGBKAIF
                                                                                                Process:C:\Users\user\Desktop\random.exe
                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                Category:dropped
                                                                                                Size (bytes):2990472
                                                                                                Entropy (8bit):6.459856200541649
                                                                                                Encrypted:false
                                                                                                SSDEEP:49152:/INqIwJA7BYAzLOhHpB63X4oQaM35DhnSYf7bPZcYsO5+th1:wNqC7BZEHSQz5DhnSy7ujL
                                                                                                MD5:B826DD92D78EA2526E465A34324EBEEA
                                                                                                SHA1:BF8A0093ACFD2EB93C102E1A5745FB080575372E
                                                                                                SHA-256:7824B50ACDD144764DAC7445A4067B35CF0FEF619E451045AB6C1F54F5653A5B
                                                                                                SHA-512:1AC4B731B9B31CABF3B1C43AEE37206AEE5326C8E786ABE2AB38E031633B778F97F2D6545CF745C3066F3BD47B7AAF2DED2F9955475428100EAF271DD9AEEF17
                                                                                                Malicious:true
                                                                                                Yara Hits:
                                                                                                • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\Users\user\AppData\Local\Temp\svchost015.exe, Author: Joe Security
                                                                                                • Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\svchost015.exe, Author: Joe Security
                                                                                                Antivirus:
                                                                                                • Antivirus: ReversingLabs, Detection: 4%
                                                                                                Joe Sandbox View:
                                                                                                • Filename: random.exe, Detection: malicious, Browse
                                                                                                • Filename: random.exe, Detection: malicious, Browse
                                                                                                • Filename: random.exe, Detection: malicious, Browse
                                                                                                • Filename: random.exe, Detection: malicious, Browse
                                                                                                • Filename: random.exe, Detection: malicious, Browse
                                                                                                • Filename: random.exe, Detection: malicious, Browse
                                                                                                • Filename: random.exe, Detection: malicious, Browse
                                                                                                • Filename: random.exe, Detection: malicious, Browse
                                                                                                • Filename: random.exe, Detection: malicious, Browse
                                                                                                • Filename: random.exe, Detection: malicious, Browse
                                                                                                Reputation:moderate, very likely benign file
                                                                                                Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....\"f..................#.........l.#.......#...@..........................p1.....?.-...`...(..@...........................p&.l3....(...............-..!....................................&.....................................................CODE......#.......#................. ..`DATA....0.....#.......#.............@...BSS...........$......\$..................idata..l3...p&..4...\$.............@....tls....|.....&.......$..................rdata........&.......$.............@..P.reloc.......&.......$.............@..P.rsrc.........(.......$.............@..P.............p1......,/.............@..P........................................................................................................................................
                                                                                                File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                Entropy (8bit):7.970334868731966
                                                                                                TrID:
                                                                                                • Win32 Executable (generic) a (10002005/4) 99.94%
                                                                                                • Win16/32 Executable Delphi generic (2074/23) 0.02%
                                                                                                • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                • DOS Executable Generic (2002/1) 0.02%
                                                                                                • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                File name:random.exe
                                                                                                File size:5'082'112 bytes
                                                                                                MD5:c09bbe60622793d6268a68cd215d28d2
                                                                                                SHA1:0a8c61f3bf061e0b9e4ec9d59df67d75910e9bd5
                                                                                                SHA256:644635088b2922ed3fced650a1d88e140b2bc8b3553c8bc741c0f55a94c7476e
                                                                                                SHA512:5545278424fb4fc896371a933b915d17af3f873bae57dc4ac91dfb51de01bc8cf0607577b908d5964eedb6488d6790a62a063399bd99ce805eae48264f2ef62c
                                                                                                SSDEEP:98304:b8ZFjmtaqsfU1q9bo0zHgoLOCEsWr9QSUHXNcvQQgMxiWJ5VWMdWHVIh9:ArtfUY9bxoCETpQhHX+vQQgMx3JXqI
                                                                                                TLSH:8F36339BB00E9410C5D101B09097FD785F22ED9DC08F669EE7893A2FF873A49972617B
                                                                                                File Content Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................
                                                                                                Icon Hash:17b0ce4617456913
                                                                                                Entrypoint:0xd21000
                                                                                                Entrypoint Section:.taggant
                                                                                                Digitally signed:false
                                                                                                Imagebase:0x400000
                                                                                                Subsystem:windows gui
                                                                                                Image File Characteristics:EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
                                                                                                DLL Characteristics:
                                                                                                Time Stamp:0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
                                                                                                TLS Callbacks:
                                                                                                CLR (.Net) Version:
                                                                                                OS Version Major:4
                                                                                                OS Version Minor:0
                                                                                                File Version Major:4
                                                                                                File Version Minor:0
                                                                                                Subsystem Version Major:4
                                                                                                Subsystem Version Minor:0
                                                                                                Import Hash:2eabe9054cad5152567f0699947a2c5b
                                                                                                Instruction
                                                                                                jmp 00007F3071013B1Ah
                                                                                                punpckhdq mm1, qword ptr [ebp+00h]
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                jmp 00007F3071015B15h
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add ah, dl
                                                                                                add dword ptr [eax], eax
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [ecx], al
                                                                                                add byte ptr [eax], 00000000h
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                jnle 00007F3071013A92h
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                jl 00007F3071013B13h
                                                                                                add byte ptr [eax], al
                                                                                                push es
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [ecx], al
                                                                                                add byte ptr [eax], 00000000h
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add dword ptr [eax+00000000h], 00000000h
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                add byte ptr [eax], al
                                                                                                NameVirtual AddressVirtual Size Is in Section
                                                                                                IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                IMAGE_DIRECTORY_ENTRY_IMPORT0x4540600x74.idata
                                                                                                IMAGE_DIRECTORY_ENTRY_RESOURCE0xe00000x373c8c.rsrc
                                                                                                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                IMAGE_DIRECTORY_ENTRY_BASERELOC0x8df4dc0x10crvwvere
                                                                                                IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                IMAGE_DIRECTORY_ENTRY_TLS0x8df48c0x18crvwvere
                                                                                                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                                                                                                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
                                                                                                NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                0x10000xdf0000x53a0023e604bfea9d0362617bb252556f5bfdFalse0.9986920777279522data7.9733396056544IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                .rsrc0xe00000x373c8c0x299000c97157d4f476931f4e872382826d6524unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                .idata 0x4540000x10000x200e9226717851e3de96e144d64b86cf1c8False0.154296875data1.1430978259222817IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                0x4550000x2e20000x200e7e724cadcdf270c7340579bc62269dfunknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                crvwvere0x7370000x1e90000x1e880089d41689352deeddd20ef4f01cb8b74dFalse0.9595616163958547data7.892877819014468IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                rioauvav0x9200000x10000x4001efddf6d93a2847f1c21c68da59e424eFalse0.8076171875data6.304106641486217IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                .taggant0x9210000x30000x22003c7890f31b86fb107bdbe622f1998dafFalse0.06870404411764706DOS executable (COM)0.7808534591627481IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                TREGQWEFA0xe0ecc0x32d5b4dataEnglishUnited States1.0003108978271484
                                                                                                RT_CURSOR0x40e4800x134empty0
                                                                                                RT_CURSOR0x40e5b40x134empty0
                                                                                                RT_CURSOR0x40e6e80x134empty0
                                                                                                RT_CURSOR0x40e81c0x134empty0
                                                                                                RT_CURSOR0x40e9500x134empty0
                                                                                                RT_CURSOR0x40ea840x134empty0
                                                                                                RT_CURSOR0x40ebb80x134empty0
                                                                                                RT_BITMAP0x40ecec0x1d0empty0
                                                                                                RT_BITMAP0x40eebc0x1e4empty0
                                                                                                RT_BITMAP0x40f0a00x1d0empty0
                                                                                                RT_BITMAP0x40f2700x1d0empty0
                                                                                                RT_BITMAP0x40f4400x1d0empty0
                                                                                                RT_BITMAP0x40f6100x1d0empty0
                                                                                                RT_BITMAP0x40f7e00x1d0empty0
                                                                                                RT_BITMAP0x40f9b00x1d0empty0
                                                                                                RT_BITMAP0x40fb800x1d0empty0
                                                                                                RT_BITMAP0x40fd500x1d0empty0
                                                                                                RT_BITMAP0x40ff200xe8empty0
                                                                                                RT_ICON0x8df4ec0xca4dPNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.9999613817606056
                                                                                                RT_ICON0x8ebf390x4c28Device independent bitmap graphic, 128 x 256 x 8, image size 16384, 256 important colors0.3874128026261797
                                                                                                RT_ICON0x8f0b610x1628Device independent bitmap graphic, 64 x 128 x 8, image size 4096, 256 important colors0.5331452750352609
                                                                                                RT_ICON0x8f21890xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors0.5876865671641791
                                                                                                RT_ICON0x8f30310x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors0.7396209386281588
                                                                                                RT_ICON0x8f38d90x6c8Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors0.7332949308755761
                                                                                                RT_ICON0x8f3fa10x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors0.4956647398843931
                                                                                                RT_ICON0x8f45090x11e8ePNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced1.00014994956242
                                                                                                RT_ICON0x9063970x10828Device independent bitmap graphic, 128 x 256 x 32, image size 675840.4515260854134627
                                                                                                RT_ICON0x916bbf0x4228Device independent bitmap graphic, 64 x 128 x 32, image size 168960.5061407652338215
                                                                                                RT_ICON0x91ade70x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 96000.5747925311203319
                                                                                                RT_ICON0x91d38f0x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 42240.6064727954971857
                                                                                                RT_ICON0x91e4370x988Device independent bitmap graphic, 24 x 48 x 32, image size 24000.6602459016393443
                                                                                                RT_ICON0x91edbf0x468Device independent bitmap graphic, 16 x 32 x 32, image size 10880.7030141843971631
                                                                                                RT_DIALOG0x44fd480x52empty0
                                                                                                RT_STRING0x44fd9c0x118empty0
                                                                                                RT_STRING0x44feb40x324empty0
                                                                                                RT_STRING0x4501d80x418empty0
                                                                                                RT_STRING0x4505f00x43cempty0
                                                                                                RT_STRING0x450a2c0x1e4empty0
                                                                                                RT_STRING0x450c100x1a4empty0
                                                                                                RT_STRING0x450db40x11cempty0
                                                                                                RT_STRING0x450ed00x2b8empty0
                                                                                                RT_STRING0x4511880xe0empty0
                                                                                                RT_STRING0x4512680x10cempty0
                                                                                                RT_STRING0x4513740x370empty0
                                                                                                RT_STRING0x4516e40x3c4empty0
                                                                                                RT_STRING0x451aa80x3b8empty0
                                                                                                RT_STRING0x451e600x3b0empty0
                                                                                                RT_STRING0x4522100xf0empty0
                                                                                                RT_STRING0x4523000xc0empty0
                                                                                                RT_STRING0x4523c00x2d8empty0
                                                                                                RT_STRING0x4526980x49cempty0
                                                                                                RT_STRING0x452b340x388empty0
                                                                                                RT_STRING0x452ebc0x2f0empty0
                                                                                                RT_RCDATA0x4531ac0x10empty0
                                                                                                RT_RCDATA0x4531bc0x504empty0
                                                                                                RT_RCDATA0x4536c00x14bempty0
                                                                                                RT_GROUP_CURSOR0x45380c0x14empty0
                                                                                                RT_GROUP_CURSOR0x4538200x14empty0
                                                                                                RT_GROUP_CURSOR0x4538340x14empty0
                                                                                                RT_GROUP_CURSOR0x4538480x14empty0
                                                                                                RT_GROUP_CURSOR0x45385c0x14empty0
                                                                                                RT_GROUP_CURSOR0x4538700x14empty0
                                                                                                RT_GROUP_CURSOR0x4538840x14empty0
                                                                                                RT_GROUP_ICON0x91f2270xcadata0.6089108910891089
                                                                                                RT_VERSION0x91f2f10x1d4data0.5192307692307693
                                                                                                RT_MANIFEST0x91f4c50x152ASCII text, with CRLF line terminators0.6479289940828402
                                                                                                DLLImport
                                                                                                kernel32.dlllstrcpy
                                                                                                Language of compilation systemCountry where language is spokenMap
                                                                                                EnglishUnited States

                                                                                                Download Network PCAP: filteredfull

                                                                                                • Total Packets: 31
                                                                                                • 443 (HTTPS)
                                                                                                • 80 (HTTP)
                                                                                                • 53 (DNS)
                                                                                                TimestampSource PortDest PortSource IPDest IP
                                                                                                Apr 27, 2025 10:07:28.617063999 CEST49695443192.168.2.5142.250.68.225
                                                                                                Apr 27, 2025 10:07:28.617110968 CEST44349695142.250.68.225192.168.2.5
                                                                                                Apr 27, 2025 10:07:28.617182970 CEST49695443192.168.2.5142.250.68.225
                                                                                                Apr 27, 2025 10:07:28.626394987 CEST49695443192.168.2.5142.250.68.225
                                                                                                Apr 27, 2025 10:07:28.626405954 CEST44349695142.250.68.225192.168.2.5
                                                                                                Apr 27, 2025 10:07:28.946770906 CEST44349695142.250.68.225192.168.2.5
                                                                                                Apr 27, 2025 10:07:28.946891069 CEST49695443192.168.2.5142.250.68.225
                                                                                                Apr 27, 2025 10:07:29.115669966 CEST49695443192.168.2.5142.250.68.225
                                                                                                Apr 27, 2025 10:07:29.115689993 CEST44349695142.250.68.225192.168.2.5
                                                                                                Apr 27, 2025 10:07:29.116049051 CEST44349695142.250.68.225192.168.2.5
                                                                                                Apr 27, 2025 10:07:29.116102934 CEST49695443192.168.2.5142.250.68.225
                                                                                                Apr 27, 2025 10:07:29.118863106 CEST49695443192.168.2.5142.250.68.225
                                                                                                Apr 27, 2025 10:07:29.160273075 CEST44349695142.250.68.225192.168.2.5
                                                                                                Apr 27, 2025 10:07:31.455312014 CEST44349695142.250.68.225192.168.2.5
                                                                                                Apr 27, 2025 10:07:31.455454111 CEST44349695142.250.68.225192.168.2.5
                                                                                                Apr 27, 2025 10:07:31.455542088 CEST49695443192.168.2.5142.250.68.225
                                                                                                Apr 27, 2025 10:07:31.455542088 CEST49695443192.168.2.5142.250.68.225
                                                                                                Apr 27, 2025 10:07:31.476330996 CEST49695443192.168.2.5142.250.68.225
                                                                                                Apr 27, 2025 10:07:31.476372004 CEST44349695142.250.68.225192.168.2.5
                                                                                                Apr 27, 2025 10:07:37.214844942 CEST4969680192.168.2.5185.156.72.196
                                                                                                Apr 27, 2025 10:07:38.224796057 CEST4969680192.168.2.5185.156.72.196
                                                                                                Apr 27, 2025 10:07:40.224725008 CEST4969680192.168.2.5185.156.72.196
                                                                                                Apr 27, 2025 10:07:44.224788904 CEST4969680192.168.2.5185.156.72.196
                                                                                                Apr 27, 2025 10:07:52.240413904 CEST4969680192.168.2.5185.156.72.196
                                                                                                Apr 27, 2025 10:08:01.073637962 CEST4969880192.168.2.5185.156.72.196
                                                                                                Apr 27, 2025 10:08:02.084146023 CEST4969880192.168.2.5185.156.72.196
                                                                                                Apr 27, 2025 10:08:04.084223986 CEST4969880192.168.2.5185.156.72.196
                                                                                                Apr 27, 2025 10:08:08.084342957 CEST4969880192.168.2.5185.156.72.196
                                                                                                Apr 27, 2025 10:08:16.084180117 CEST4969880192.168.2.5185.156.72.196
                                                                                                Apr 27, 2025 10:08:24.538077116 CEST4969980192.168.2.5185.156.72.196
                                                                                                Apr 27, 2025 10:08:25.552979946 CEST4969980192.168.2.5185.156.72.196
                                                                                                Apr 27, 2025 10:08:27.553023100 CEST4969980192.168.2.5185.156.72.196
                                                                                                Apr 27, 2025 10:08:31.552973986 CEST4969980192.168.2.5185.156.72.196
                                                                                                Apr 27, 2025 10:08:39.553092957 CEST4969980192.168.2.5185.156.72.196
                                                                                                Apr 27, 2025 10:08:47.290822029 CEST4970080192.168.2.5185.156.72.196
                                                                                                Apr 27, 2025 10:08:48.303015947 CEST4970080192.168.2.5185.156.72.196
                                                                                                Apr 27, 2025 10:08:50.302994013 CEST4970080192.168.2.5185.156.72.196
                                                                                                Apr 27, 2025 10:08:54.303056002 CEST4970080192.168.2.5185.156.72.196
                                                                                                Apr 27, 2025 10:09:02.303028107 CEST4970080192.168.2.5185.156.72.196
                                                                                                TimestampSource PortDest PortSource IPDest IP
                                                                                                Apr 27, 2025 10:07:28.469089985 CEST5213553192.168.2.51.1.1.1
                                                                                                Apr 27, 2025 10:07:28.609375000 CEST53521351.1.1.1192.168.2.5
                                                                                                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                Apr 27, 2025 10:07:28.469089985 CEST192.168.2.51.1.1.10xadb6Standard query (0)drive.usercontent.google.comA (IP address)IN (0x0001)false
                                                                                                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                Apr 27, 2025 10:07:28.609375000 CEST1.1.1.1192.168.2.50xadb6No error (0)drive.usercontent.google.com142.250.68.225A (IP address)IN (0x0001)false
                                                                                                • drive.usercontent.google.com
                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                0192.168.2.549695142.250.68.2254436488C:\Users\user\AppData\Local\Temp\svchost015.exe
                                                                                                TimestampBytes transferredDirectionData
                                                                                                2025-04-27 08:07:29 UTC463OUTGET /download?id=1YBVIDkZgygNfUU2rbJXXCYdrzay5rMdY&export=download&authuser=0&confirm=t HTTP/1.1
                                                                                                Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                                                                                                Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                                                                                                Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                                                                                                Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                                                                                                Host: drive.usercontent.google.com
                                                                                                Connection: Keep-Alive
                                                                                                Cache-Control: no-cache
                                                                                                2025-04-27 08:07:31 UTC5119INHTTP/1.1 200 OK
                                                                                                X-GUploader-UploadID: AAO2Vwo2eOiKiO-XdWy99MsK8kEJeNZX9GrRyftLpcKnnhB745-cZHZDMj__N5Af6wkdwE_XT1HXd-c
                                                                                                Content-Type: application/octet-stream
                                                                                                Content-Security-Policy: sandbox
                                                                                                Content-Security-Policy: default-src 'none'
                                                                                                Content-Security-Policy: frame-ancestors 'none'
                                                                                                X-Content-Security-Policy: sandbox
                                                                                                Cross-Origin-Opener-Policy: same-origin
                                                                                                Cross-Origin-Embedder-Policy: require-corp
                                                                                                Cross-Origin-Resource-Policy: same-site
                                                                                                X-Content-Type-Options: nosniff
                                                                                                Content-Disposition: attachment; filename="text"
                                                                                                Access-Control-Allow-Origin: *
                                                                                                Access-Control-Allow-Credentials: false
                                                                                                Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, User-Agent, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData- [TRUNCATED]
                                                                                                Access-Control-Allow-Methods: GET,HEAD,OPTIONS
                                                                                                Accept-Ranges: bytes
                                                                                                Content-Length: 14
                                                                                                Last-Modified: Sat, 26 Apr 2025 16:45:52 GMT
                                                                                                Date: Sun, 27 Apr 2025 08:07:31 GMT
                                                                                                Expires: Sun, 27 Apr 2025 08:07:31 GMT
                                                                                                Cache-Control: private, max-age=0
                                                                                                X-Goog-Hash: crc32c=v8xQQQ==
                                                                                                Server: UploadServer
                                                                                                Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                                Connection: close
                                                                                                2025-04-27 08:07:31 UTC14INData Raw: 41 48 45 4b 41 45 46 4b 47 42 4b 41 49 46
                                                                                                Data Ascii: AHEKAEFKGBKAIF


                                                                                                050100s020406080100

                                                                                                Click to jump to process

                                                                                                050100s0.00102030MB

                                                                                                Click to jump to process

                                                                                                • File
                                                                                                • Registry

                                                                                                Click to dive into process behavior distribution

                                                                                                Click to jump to process

                                                                                                Target ID:1
                                                                                                Start time:04:06:55
                                                                                                Start date:27/04/2025
                                                                                                Path:C:\Users\user\Desktop\random.exe
                                                                                                Wow64 process (32bit):true
                                                                                                Commandline:"C:\Users\user\Desktop\random.exe"
                                                                                                Imagebase:0x400000
                                                                                                File size:5'082'112 bytes
                                                                                                MD5 hash:C09BBE60622793D6268A68CD215D28D2
                                                                                                Has elevated privileges:true
                                                                                                Has administrator privileges:true
                                                                                                Programmed in:Borland Delphi
                                                                                                Yara matches:
                                                                                                • Rule: JoeSecurity_Crypt, Description: Yara detected CryptOne packer, Source: 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                • Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                Reputation:low
                                                                                                Has exited:true
                                                                                                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                                                                                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                                                                                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

                                                                                                Target ID:3
                                                                                                Start time:04:07:24
                                                                                                Start date:27/04/2025
                                                                                                Path:C:\Users\user\AppData\Local\Temp\svchost015.exe
                                                                                                Wow64 process (32bit):true
                                                                                                Commandline:"C:\Users\user\Desktop\random.exe"
                                                                                                Imagebase:0x400000
                                                                                                File size:2'990'472 bytes
                                                                                                MD5 hash:B826DD92D78EA2526E465A34324EBEEA
                                                                                                Has elevated privileges:true
                                                                                                Has administrator privileges:true
                                                                                                Programmed in:C, C++ or other language
                                                                                                Yara matches:
                                                                                                • Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000003.00000000.1599518700.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Author: Joe Security
                                                                                                • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\Users\user\AppData\Local\Temp\svchost015.exe, Author: Joe Security
                                                                                                • Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\svchost015.exe, Author: Joe Security
                                                                                                Antivirus matches:
                                                                                                • Detection: 4%, ReversingLabs
                                                                                                Reputation:moderate
                                                                                                Has exited:false
                                                                                                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                                                                                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                                                                                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                                                                                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                                                                                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                                                                                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                                                                                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                                                                                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

                                                                                                Executed Functions

                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647764860.0000000005260000.00000040.00001000.00020000.00000000.sdmp, Offset: 05260000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5260000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: c182915b434461cb2070259d7175e78fbda42c1a1b2f14d82075949b55a2f068
                                                                                                • Instruction ID: f77d690fa3d19ff8e7645660537867b2d7ced38389b8161e496520ab93d7e1a4
                                                                                                • Opcode Fuzzy Hash: c182915b434461cb2070259d7175e78fbda42c1a1b2f14d82075949b55a2f068
                                                                                                • Instruction Fuzzy Hash: E9318DFB57D121AEB102C1456B28EFB676EEAC6B74330C82BF507D6542D2D80E89B171
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647651751.0000000005200000.00000040.00001000.00020000.00000000.sdmp, Offset: 05200000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5200000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: c5be185e32bef8fa0e0dca0104faad68c5be4fd51d7269289248002f70fcb5a8
                                                                                                • Instruction ID: a3233ab7c629f67765061306b6381e23fd1a81d63480f6423e1a3124646ad292
                                                                                                • Opcode Fuzzy Hash: c5be185e32bef8fa0e0dca0104faad68c5be4fd51d7269289248002f70fcb5a8
                                                                                                • Instruction Fuzzy Hash: DAD0228B1FB249AE3300E192270C77B320788F73316F0B033E0032908380C4095A6025
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647706896.0000000005230000.00000040.00001000.00020000.00000000.sdmp, Offset: 05230000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5230000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: t7?+$|-]
                                                                                                • API String ID: 0-867377943
                                                                                                • Opcode ID: 3028666507d3406fa77329dc0693531a6a12ad32c9cf66663ea027ffc6211983
                                                                                                • Instruction ID: 684c10e408a2707eb8c2b469876cbc79e818942f43e721822d458a7ee530935f
                                                                                                • Opcode Fuzzy Hash: 3028666507d3406fa77329dc0693531a6a12ad32c9cf66663ea027ffc6211983
                                                                                                • Instruction Fuzzy Hash: 4C51DFEB1AC114BDB243C6866F599FA7A2FF9C73307308436F843D2502E2D54E5A6571
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647706896.0000000005230000.00000040.00001000.00020000.00000000.sdmp, Offset: 05230000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5230000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: t7?+$|-]
                                                                                                • API String ID: 0-867377943
                                                                                                • Opcode ID: d31eba2c3e4e76d5455b1b615eda7fb0a3e8d5319007e1f0e68716b7d56fa6d4
                                                                                                • Instruction ID: e2827c37cd68db298f8e2d0d567d75f1953955006128cc7a6bf727e33824ae7f
                                                                                                • Opcode Fuzzy Hash: d31eba2c3e4e76d5455b1b615eda7fb0a3e8d5319007e1f0e68716b7d56fa6d4
                                                                                                • Instruction Fuzzy Hash: 4051ECEB1AC110BDB242CA866F599FB7A2FFAC77307318036F843D2402E2D44E5A6570
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647706896.0000000005230000.00000040.00001000.00020000.00000000.sdmp, Offset: 05230000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5230000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: t7?+$|-]
                                                                                                • API String ID: 0-867377943
                                                                                                • Opcode ID: 6c1e862ea53a9ef5433b4c9b768c4d0893d7c6a56cb8d1983bac1b9d168f18c1
                                                                                                • Instruction ID: cc40337017815615210c39273c0bb5c7b481f0f7633411fd9ab567cd2d401cd2
                                                                                                • Opcode Fuzzy Hash: 6c1e862ea53a9ef5433b4c9b768c4d0893d7c6a56cb8d1983bac1b9d168f18c1
                                                                                                • Instruction Fuzzy Hash: FA51DCEB1AC114BDB242C6862F599FA6A2FFAC77303318036F803D2406E2D44E596571
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647706896.0000000005230000.00000040.00001000.00020000.00000000.sdmp, Offset: 05230000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5230000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: t7?+$|-]
                                                                                                • API String ID: 0-867377943
                                                                                                • Opcode ID: 2ecca7b6a5f6998e3f21f6ce937e0f19ba5f0c5f2b762958ceedf063475dcc8a
                                                                                                • Instruction ID: 5f106d0544cd0b5548a3c3121ae37a0b9268415da0bf0f0c2334c5b8ce44dff4
                                                                                                • Opcode Fuzzy Hash: 2ecca7b6a5f6998e3f21f6ce937e0f19ba5f0c5f2b762958ceedf063475dcc8a
                                                                                                • Instruction Fuzzy Hash: 1551DFEB1AC114BDB342C6866F599FA7A2FFAC77307318436F803E2406E2D44E196571
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647706896.0000000005230000.00000040.00001000.00020000.00000000.sdmp, Offset: 05230000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5230000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: t7?+$|-]
                                                                                                • API String ID: 0-867377943
                                                                                                • Opcode ID: d3b9fd592c0ddc59c85865a6a782fcf93e482fd2297d7572c347c3518bf63414
                                                                                                • Instruction ID: cff32eda360ea7ca8cde806b8e55834a744a3982d18981f57b802d6b194555e3
                                                                                                • Opcode Fuzzy Hash: d3b9fd592c0ddc59c85865a6a782fcf93e482fd2297d7572c347c3518bf63414
                                                                                                • Instruction Fuzzy Hash: 1651CDEB1AC114BDB342C6862F599FA6A6FEAC7330731803AF843E1402E2D54E5A6571
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647706896.0000000005230000.00000040.00001000.00020000.00000000.sdmp, Offset: 05230000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5230000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: t7?+$|-]
                                                                                                • API String ID: 0-867377943
                                                                                                • Opcode ID: e16f74957013c3a7f80e02f2e1bca88816778bda90fbb98c8f89730385081d3d
                                                                                                • Instruction ID: 1848b2fb229d81cfda537c64cf7bca9d98f9ad4e6c92a9cc75f0f7dfdce4366b
                                                                                                • Opcode Fuzzy Hash: e16f74957013c3a7f80e02f2e1bca88816778bda90fbb98c8f89730385081d3d
                                                                                                • Instruction Fuzzy Hash: 1751CDEB1A8114BEB642C6866F599FBBA7FFAC7730331843AF803D1402E2D44E196571
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647706896.0000000005230000.00000040.00001000.00020000.00000000.sdmp, Offset: 05230000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5230000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: t7?+$|-]
                                                                                                • API String ID: 0-867377943
                                                                                                • Opcode ID: 0c8e4abe3038c6ce114b2bf26702be31bb7836fc057a8684479a0ba1cd800fb1
                                                                                                • Instruction ID: fe680eca08bb033deb60938435506fb9b5b7d251bff7e0801dbe82b48b1c277a
                                                                                                • Opcode Fuzzy Hash: 0c8e4abe3038c6ce114b2bf26702be31bb7836fc057a8684479a0ba1cd800fb1
                                                                                                • Instruction Fuzzy Hash: 5F41DDEB1AC114BDB242C6866F599FB6B7FEAC7730330843AF803E1402E2D44E5A6531
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647706896.0000000005230000.00000040.00001000.00020000.00000000.sdmp, Offset: 05230000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5230000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: t7?+$|-]
                                                                                                • API String ID: 0-867377943
                                                                                                • Opcode ID: a02449332279acddc5a47e46c5d185ffce79bdae0fcdff791f7a0a507496d27b
                                                                                                • Instruction ID: c5e3f1aa3887ce050f58102b7d8c713b7fd2210dbed764187facac0a4d71a3c2
                                                                                                • Opcode Fuzzy Hash: a02449332279acddc5a47e46c5d185ffce79bdae0fcdff791f7a0a507496d27b
                                                                                                • Instruction Fuzzy Hash: 7E41DEEB1AC114BEF70286856B699FB7B7FE9C7330730803AF842D1402E2D54E0A6571
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647706896.0000000005230000.00000040.00001000.00020000.00000000.sdmp, Offset: 05230000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5230000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: t7?+$|-]
                                                                                                • API String ID: 0-867377943
                                                                                                • Opcode ID: cd0a5416c1d3b95f0d77f9ced7faff7c307fc5f0ad6b4b08237f74b6ce1088ee
                                                                                                • Instruction ID: 1c53f5699f30218f63cf6566a0dc4ce94683c00b87b28ffaa6f38f860632939c
                                                                                                • Opcode Fuzzy Hash: cd0a5416c1d3b95f0d77f9ced7faff7c307fc5f0ad6b4b08237f74b6ce1088ee
                                                                                                • Instruction Fuzzy Hash: 65419BEB1A8114BDB642C6856F599FBAB7FEAC7730330803AF842E1402E2D54E19A171
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647706896.0000000005230000.00000040.00001000.00020000.00000000.sdmp, Offset: 05230000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5230000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: t7?+$|-]
                                                                                                • API String ID: 0-867377943
                                                                                                • Opcode ID: fe290e30bc7ca537831d92689ff8d97f62e73aadbfabd0d5618344d428acbf4d
                                                                                                • Instruction ID: ba4bcd5e51380fcddfae8c9c0fc90c8e14ed4939846115bd8f00e2e972ada613
                                                                                                • Opcode Fuzzy Hash: fe290e30bc7ca537831d92689ff8d97f62e73aadbfabd0d5618344d428acbf4d
                                                                                                • Instruction Fuzzy Hash: D941AFEB1A8114BDB642CA856F599FB7B7FF9C77303308436F842D1402E2D54E196571
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647706896.0000000005230000.00000040.00001000.00020000.00000000.sdmp, Offset: 05230000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5230000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: t7?+$|-]
                                                                                                • API String ID: 0-867377943
                                                                                                • Opcode ID: 7a848a7f952e9f979289bef5b35405eed5711da29a48558760833f9e513671c9
                                                                                                • Instruction ID: c3cbec749b9a502cb81b1cce102478fedc1d7c450c669e6fa0f819ec612cb7ce
                                                                                                • Opcode Fuzzy Hash: 7a848a7f952e9f979289bef5b35405eed5711da29a48558760833f9e513671c9
                                                                                                • Instruction Fuzzy Hash: 1531D3EB1A8114BEB702C5856F699FB7B7FFAC63307308026F842D2402E2D54E196171
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647821318.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5290000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: P
                                                                                                • API String ID: 0-3110715001
                                                                                                • Opcode ID: 0786ff101ce37e0edb98d763452c6022032bf42906c049578e4b449fbca8491a
                                                                                                • Instruction ID: 43267a3c91d8aae8e3ca19d665a2a8836304d52ce77c75bfb98dbd0447fcc9ae
                                                                                                • Opcode Fuzzy Hash: 0786ff101ce37e0edb98d763452c6022032bf42906c049578e4b449fbca8491a
                                                                                                • Instruction Fuzzy Hash: 8B41B4EB27D11ABCB94AC0412B6CAFB572FEED6B303308526F507D6742E2D44A4D1071
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647706896.0000000005230000.00000040.00001000.00020000.00000000.sdmp, Offset: 05230000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5230000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: t7?+
                                                                                                • API String ID: 0-274712766
                                                                                                • Opcode ID: 73734e359cfc6ff4e8e7dd14b44d83ea4bfa1582a8522040e84eacddc8f42c96
                                                                                                • Instruction ID: e43ebf461efb0c6cb05aae35bc713f87a10d7a1f8e2f06c378ccc18662b40766
                                                                                                • Opcode Fuzzy Hash: 73734e359cfc6ff4e8e7dd14b44d83ea4bfa1582a8522040e84eacddc8f42c96
                                                                                                • Instruction Fuzzy Hash: CC31BCFB168124BEB642C9856F699FB7B6FEAC73307318036F802D1402E2D54E596270
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647706896.0000000005230000.00000040.00001000.00020000.00000000.sdmp, Offset: 05230000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5230000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: t7?+
                                                                                                • API String ID: 0-274712766
                                                                                                • Opcode ID: dca37eead069650f2cf1e6c77cce948d2c263beb453f6548cf9933f5b4810103
                                                                                                • Instruction ID: 622d4388fc63c276b10f8378e66e21db0176b4283dc77a7ecc53d9223a01e0c4
                                                                                                • Opcode Fuzzy Hash: dca37eead069650f2cf1e6c77cce948d2c263beb453f6548cf9933f5b4810103
                                                                                                • Instruction Fuzzy Hash: BA319CFB1A8124BDB643C9856F699FA7B6FEAC73307308036F802D1402E2D54E596171
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647706896.0000000005230000.00000040.00001000.00020000.00000000.sdmp, Offset: 05230000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5230000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: t7?+
                                                                                                • API String ID: 0-274712766
                                                                                                • Opcode ID: a23f19a2c43571f18bbd9303c4fa0e61241b354ae83b8f3f2885e767b474a3c9
                                                                                                • Instruction ID: d4cc4ed6921998ebcd61e5807835ffb49ff73870aa8f4c7597111fc204dc51ed
                                                                                                • Opcode Fuzzy Hash: a23f19a2c43571f18bbd9303c4fa0e61241b354ae83b8f3f2885e767b474a3c9
                                                                                                • Instruction Fuzzy Hash: 01319EFB0A8114BDF743C9856B699FA7B6FEAC73307308076F84291402E2D54E596271
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647706896.0000000005230000.00000040.00001000.00020000.00000000.sdmp, Offset: 05230000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5230000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: t7?+
                                                                                                • API String ID: 0-274712766
                                                                                                • Opcode ID: 8e6f4f5f0f4e26778e4f6781705f77c70472126be19220c659084b3818385499
                                                                                                • Instruction ID: 7c3065c1366bbe7a0ad9ec34a6f164d9eb7cab274dcc9e677f3aa3b2f591df85
                                                                                                • Opcode Fuzzy Hash: 8e6f4f5f0f4e26778e4f6781705f77c70472126be19220c659084b3818385499
                                                                                                • Instruction Fuzzy Hash: 8E317FFB1A8114BDB74389856B599FA7B6FFAC73307308036F84291402E2D54E596671
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1648357966.0000000005440000.00000040.00001000.00020000.00000000.sdmp, Offset: 05440000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5440000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: kZX
                                                                                                • API String ID: 0-3688383686
                                                                                                • Opcode ID: 68605d47081e27fd37b3063eadb58608b83db535509103224a3fc4e4218bd095
                                                                                                • Instruction ID: 94a68ea61897e57370e3e9c36be9e3c1c9d8c10d2951ca188c08202517b289d7
                                                                                                • Opcode Fuzzy Hash: 68605d47081e27fd37b3063eadb58608b83db535509103224a3fc4e4218bd095
                                                                                                • Instruction Fuzzy Hash: 14F059160CD2C84DE702C6E1095C5E53F67DD43F743200893C58E4E562916889B78EA9
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647821318.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5290000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 860e0350bb586bc415724a05e8672c2bc3467d5df54de99501ede8af558fa816
                                                                                                • Instruction ID: f8b35cf8e5875924891c516e1862b52ff62911eee24d342e65c37a36d8a889b2
                                                                                                • Opcode Fuzzy Hash: 860e0350bb586bc415724a05e8672c2bc3467d5df54de99501ede8af558fa816
                                                                                                • Instruction Fuzzy Hash: 1B41B2EB27D11ABC794AC0822B6DAFB562FEDD6730330C526F907D2742E2D44A8D1072
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647821318.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5290000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 9d2a77f869f84c7fd29476bef49f5dc6cbd306bc02a73d40c45a9e237bb9ec43
                                                                                                • Instruction ID: f66660e478242587e9cd1f93e85c9730e3b24440a0c59f028a90124d7302153f
                                                                                                • Opcode Fuzzy Hash: 9d2a77f869f84c7fd29476bef49f5dc6cbd306bc02a73d40c45a9e237bb9ec43
                                                                                                • Instruction Fuzzy Hash: 544194EB27D11ABC784AC0462B6CAFB562FEDD6730331C426F507D6742E2D44A4D1071
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647821318.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5290000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 148b2211d51d18edfc141f1add9996e436d13157f9445f0e0e7c38f91ab7f94d
                                                                                                • Instruction ID: c6790de4cfde3d2c2d9bd184e7cfd10470f21ea00d2414ceda3f742d2b7c6036
                                                                                                • Opcode Fuzzy Hash: 148b2211d51d18edfc141f1add9996e436d13157f9445f0e0e7c38f91ab7f94d
                                                                                                • Instruction Fuzzy Hash: 8E4193EB23D11ABC784AC0822B6CAFB562FEDD6B30331C426F507D5742E6D44A8E5072
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647821318.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5290000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: e81e79dde55a8b2e088b12ddc1d751fe02ddcbe25dbefe97f5d2b568f5b29302
                                                                                                • Instruction ID: b8345a6b3a9bb06e0e1617b25e843dc7b16e73dc3110a2673d08518616de4ce9
                                                                                                • Opcode Fuzzy Hash: e81e79dde55a8b2e088b12ddc1d751fe02ddcbe25dbefe97f5d2b568f5b29302
                                                                                                • Instruction Fuzzy Hash: 064184EB27C11ABC784AC0462B6CAFB562FEDD6B30331C426F907D6742E6D44A5D1072
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647821318.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5290000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 4568cae6550e9657211d8e7809eba621ea9520e1e9da055b00ee6ef8e012abbe
                                                                                                • Instruction ID: cfc3282929f30c747763e9a68db6e04520e5b2ba35c338702f6b6c97b7518805
                                                                                                • Opcode Fuzzy Hash: 4568cae6550e9657211d8e7809eba621ea9520e1e9da055b00ee6ef8e012abbe
                                                                                                • Instruction Fuzzy Hash: D94170EB27C11ABC784EC4866B6DAFB562FEDD6B30331842AF507D5742E6C44A8D1072
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647821318.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5290000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: e5751e52aa8b07736f08c749fe4e06d20e497903d81ea06053172987009167b7
                                                                                                • Instruction ID: 3e155b05f2f339d60c158f6287025f120076b640d0687d517bd5e09ce82c3b1e
                                                                                                • Opcode Fuzzy Hash: e5751e52aa8b07736f08c749fe4e06d20e497903d81ea06053172987009167b7
                                                                                                • Instruction Fuzzy Hash: C54180EB27C11ABC784AC0866B6DAFB562FEDD6B303318426F907D5742E6C44B8D1072
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647821318.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5290000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 55f010c1cc71a0ea6a0389550b2eb76e2aa5e03238e0786a5ed876adb02fc220
                                                                                                • Instruction ID: aafa33715b61d4424e89a08c9d38575c868a220079ea8b6fdfe71d385068527a
                                                                                                • Opcode Fuzzy Hash: 55f010c1cc71a0ea6a0389550b2eb76e2aa5e03238e0786a5ed876adb02fc220
                                                                                                • Instruction Fuzzy Hash: 8C4135EB17D20ABDB90EC5411B6DAFA6B2BEED7730330806AF507E6742D5C40A4D1172
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647821318.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5290000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: bd68c12224bcc5619a76b81fa3bb7a3bd0e12d073a121925a353ba86dc411ceb
                                                                                                • Instruction ID: aa89701767b9978634b331230d9a55b6f21592ecd388588bc66eb008535ea504
                                                                                                • Opcode Fuzzy Hash: bd68c12224bcc5619a76b81fa3bb7a3bd0e12d073a121925a353ba86dc411ceb
                                                                                                • Instruction Fuzzy Hash: B831A0EB17C11ABC784EC4422B6DAFA662FEDD67303308436F507D6B42D6C40A9D1072
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647821318.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5290000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 53107ded0e03dc1d548945e10164b924f6e50ae4385e880b8f08d5c9c2cd7e3e
                                                                                                • Instruction ID: 7d5d88b5b0f27ab74b86dc52b9be2932deca4aaf06791b1af140f38ddf8a3f69
                                                                                                • Opcode Fuzzy Hash: 53107ded0e03dc1d548945e10164b924f6e50ae4385e880b8f08d5c9c2cd7e3e
                                                                                                • Instruction Fuzzy Hash: EE31A2EB17D21ABD795EC4422B6DAFA562FEED67303308426F507D1B42E6C44A8D1072
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647821318.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5290000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 3b34cf5108e798a381a378cdb166612c29965567c372580516562200b47b10af
                                                                                                • Instruction ID: 4141e1d9955e2da12eb2205d9e47c19553b82b486037148473ad07fd1a2de443
                                                                                                • Opcode Fuzzy Hash: 3b34cf5108e798a381a378cdb166612c29965567c372580516562200b47b10af
                                                                                                • Instruction Fuzzy Hash: FC3190DB17D11EBC7C4EC182176DAFA562FEED6B302308426B50BA5B42A5C44A9D1072
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647764860.0000000005260000.00000040.00001000.00020000.00000000.sdmp, Offset: 05260000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5260000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: aa4348aed659569ea5f230b7995814bab9605465588734818fa5114883bba877
                                                                                                • Instruction ID: 973a9e4f6884ce455d1a620adfce2010f827bcf8f8455e62cb2cf97b00167b6c
                                                                                                • Opcode Fuzzy Hash: aa4348aed659569ea5f230b7995814bab9605465588734818fa5114883bba877
                                                                                                • Instruction Fuzzy Hash: 4A2178AB27D121BD7142C1462B28EFA676FEAD6B74330C82BF407C2542D2D40EC9B271
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647821318.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5290000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: f5d70dc1dea7ee8148b792158416fce0e3cec7aa64b281dfd578358241b1e264
                                                                                                • Instruction ID: f00f4c2c1de8b0791fece12da23ac20d08fca0aad05118a2e4dea8fba3be356e
                                                                                                • Opcode Fuzzy Hash: f5d70dc1dea7ee8148b792158416fce0e3cec7aa64b281dfd578358241b1e264
                                                                                                • Instruction Fuzzy Hash: 3621D4EB17D21EBC684ED186177DAFA5A2BAED77303308036B507A6B42A5C44B9D1072
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647764860.0000000005260000.00000040.00001000.00020000.00000000.sdmp, Offset: 05260000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5260000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 64238abde997303caef5e36baa98e23639f6c877673d9363ecd47f1a1ab172c5
                                                                                                • Instruction ID: 6dd33a834fbd93235ada5df193e0b4ea7653b1d964efa3a4d3a9b2231db866ec
                                                                                                • Opcode Fuzzy Hash: 64238abde997303caef5e36baa98e23639f6c877673d9363ecd47f1a1ab172c5
                                                                                                • Instruction Fuzzy Hash: 1121A3EB67D122ADA241C5552B28AFB576FEAC6734730C83BF407C6542D2D40DCAB171
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647821318.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5290000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: d4d0dd8ae11ab0085643d889b85228f20d266505c71637d1a1eef107444a95c7
                                                                                                • Instruction ID: 4d0cea92edb13b54dfe0c27cb9bea114a439e865649c8f4e6fc3f92ce530756c
                                                                                                • Opcode Fuzzy Hash: d4d0dd8ae11ab0085643d889b85228f20d266505c71637d1a1eef107444a95c7
                                                                                                • Instruction Fuzzy Hash: 322125EB27D10DFD6C4ED485177DAFA6A2FEDD77303308026B607A6B42A5C04A9910B2
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647821318.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5290000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 82671ab6bceecf7f3c310e6c6884c08b41f7fdb071e0a83f92c573d64a3a563a
                                                                                                • Instruction ID: dd2d5e2bd75c750ff135e964e058d5186eaf4b00a09dfb61f486c3f597d4dc1c
                                                                                                • Opcode Fuzzy Hash: 82671ab6bceecf7f3c310e6c6884c08b41f7fdb071e0a83f92c573d64a3a563a
                                                                                                • Instruction Fuzzy Hash: E821C4EB17D11EBC6C4ED486177DAFA562FEED73342308036B607A6B42A5C40B9D10B2
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647764860.0000000005260000.00000040.00001000.00020000.00000000.sdmp, Offset: 05260000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5260000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 049db929c5f3ac062119c7664041e60e6e35bf1767a389f809d74f85fd7d8946
                                                                                                • Instruction ID: 167a6006175019d90f49aadb7d17f68c9056bda4b2511da31376f3adc1aaf42c
                                                                                                • Opcode Fuzzy Hash: 049db929c5f3ac062119c7664041e60e6e35bf1767a389f809d74f85fd7d8946
                                                                                                • Instruction Fuzzy Hash: 63218EEB579122BD6242C1452B2CAFA6B6FEAC6774330C82AF407D6541D2D40EC9B1B1
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647821318.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5290000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: b28b1a57b28653684a1fe5fe08630669ac4ced0dec41dd687dadabed24807da5
                                                                                                • Instruction ID: edc013f11820954f1798a704e5d1e3eede1f4581e8def38305af9fb62176bd66
                                                                                                • Opcode Fuzzy Hash: b28b1a57b28653684a1fe5fe08630669ac4ced0dec41dd687dadabed24807da5
                                                                                                • Instruction Fuzzy Hash: 392106DB17D11DFC6C4ED481577CAFA6A2FEDD77342308026B607A6742A5C04A8910B2
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647764860.0000000005260000.00000040.00001000.00020000.00000000.sdmp, Offset: 05260000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5260000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: bea836883e3c1ef8878d428f045c938065c1a797f27f66848b5f7516c28a1849
                                                                                                • Instruction ID: 5731530a185c18226fce94694cd58d722e9147a2ad6a1fbb724dc43d0f4154e2
                                                                                                • Opcode Fuzzy Hash: bea836883e3c1ef8878d428f045c938065c1a797f27f66848b5f7516c28a1849
                                                                                                • Instruction Fuzzy Hash: 62217FEB57D122AD6141C5452B28AFA5B6FDAC6774330C82BF407C6542D2D40EC9B171
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647764860.0000000005260000.00000040.00001000.00020000.00000000.sdmp, Offset: 05260000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5260000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 7d08ec71db99da5664cf198a62403ae338bdb955241abb4bb6c8b35954b39c42
                                                                                                • Instruction ID: 0fd3c9808e0cafbe82c9f2d361538514e0bdfadf9b0f2ad05f08bda8b007c300
                                                                                                • Opcode Fuzzy Hash: 7d08ec71db99da5664cf198a62403ae338bdb955241abb4bb6c8b35954b39c42
                                                                                                • Instruction Fuzzy Hash: C9115EEB67D122ADB142C1452B28EFB576EEAC6738730C82BF407D6541D2D40EC9B171
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1648357966.0000000005440000.00000040.00001000.00020000.00000000.sdmp, Offset: 05440000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5440000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 5c905a917d85fe9b38857da001f229a7630086f4470e0d8b50cf4f011f853638
                                                                                                • Instruction ID: 2cbca41a3fc2ae3ffc39b801a84abbafd8d1d5b49c5e7728fc14cde4cf3df8d5
                                                                                                • Opcode Fuzzy Hash: 5c905a917d85fe9b38857da001f229a7630086f4470e0d8b50cf4f011f853638
                                                                                                • Instruction Fuzzy Hash: B121689719D2D4EEF246C585276CAF53B7BD9C773433400ABE20A8E513D184067B8932
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647821318.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5290000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: a0b45ad314d4d70cc69529891a9565940661329709012777e1a835e81ed2a5df
                                                                                                • Instruction ID: 92cb1fb13e987f03883c1dae4d83e062024d35f2da1733f83ee7699b2c03b4f0
                                                                                                • Opcode Fuzzy Hash: a0b45ad314d4d70cc69529891a9565940661329709012777e1a835e81ed2a5df
                                                                                                • Instruction Fuzzy Hash: AE112BDB17D10EFD4C4FD495137D6FA1A17BE973343304061B607AAB42D5C4479911A2
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647706896.0000000005230000.00000040.00001000.00020000.00000000.sdmp, Offset: 05230000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5230000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 5e7a00042b60e87813e2b4faceef460ebe14adee13f004eec1936597b5cd6425
                                                                                                • Instruction ID: 8af966878eb5668617c4b5a6b1c5fb05945f0695dfe51ca16a2bec71626091fc
                                                                                                • Opcode Fuzzy Hash: 5e7a00042b60e87813e2b4faceef460ebe14adee13f004eec1936597b5cd6425
                                                                                                • Instruction Fuzzy Hash: 1B015BEB1A8114BDB60389812F699FBAA3EE9C63303318436F942E1402A2D54E1971B1
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647706896.0000000005230000.00000040.00001000.00020000.00000000.sdmp, Offset: 05230000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5230000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 56e3644f40d08aecfe59e70deea2e05744fb470b1734ee76f1d58403e5f6a908
                                                                                                • Instruction ID: 01950f2e8e296d22b41ee4ef6ac547c8a0d28efb8eba75a953990c40e0b2e9a2
                                                                                                • Opcode Fuzzy Hash: 56e3644f40d08aecfe59e70deea2e05744fb470b1734ee76f1d58403e5f6a908
                                                                                                • Instruction Fuzzy Hash: 80010CEB1A9114BDB64385812F699FBAA3EF9C73347318436F943A0442A3D50A5971B1
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647821318.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5290000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: da545d02f445242b158f4e346c8efd6d21f2a51159b42587c64aa8cb12921407
                                                                                                • Instruction ID: 6f2a5b5aa4e67a886c17138b81142b58609ab43603056a72f56636a277a8df82
                                                                                                • Opcode Fuzzy Hash: da545d02f445242b158f4e346c8efd6d21f2a51159b42587c64aa8cb12921407
                                                                                                • Instruction Fuzzy Hash: 7E116F9B2BD20EFD8C4FC445537DABA192BBED73347304072F60797B42E5C0469951A2
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647821318.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5290000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 92b81e817a89e677b73cd9df418261fab16797859110d5f251c3aa2b2f9bfa1b
                                                                                                • Instruction ID: 13ba39fd59084eaa9f2a2a8e451cf5978b8bb69a0a947d1ba42c0ce373f313b2
                                                                                                • Opcode Fuzzy Hash: 92b81e817a89e677b73cd9df418261fab16797859110d5f251c3aa2b2f9bfa1b
                                                                                                • Instruction Fuzzy Hash: 62114E9B6BD20EFD8C4FD449537DABA292BBEAB3347304472B607E6B41D5C0478911E2
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647706896.0000000005230000.00000040.00001000.00020000.00000000.sdmp, Offset: 05230000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5230000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 21355c9ec4b32ae97685d6a391d1d254e6bad212f16e5b8bb97d40281b223f19
                                                                                                • Instruction ID: 343be39e194eb6dc4033b31fd844446f0a00088958a7a5150362145a4d1b5084
                                                                                                • Opcode Fuzzy Hash: 21355c9ec4b32ae97685d6a391d1d254e6bad212f16e5b8bb97d40281b223f19
                                                                                                • Instruction Fuzzy Hash: 7A015EEB1A9114BDB74389812F699FB7A3EFAC67307318436F943A0402A2D50E5975B1
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1648357966.0000000005440000.00000040.00001000.00020000.00000000.sdmp, Offset: 05440000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5440000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: ba1eeb43a4c17d709f60a4fad16c8664e624bae652eac2c2a568b236c1a03b71
                                                                                                • Instruction ID: 578a8a8fda862a4f9462dd7aaf8a46c116da1a40f9391dbe5cfc5a8cb7571823
                                                                                                • Opcode Fuzzy Hash: ba1eeb43a4c17d709f60a4fad16c8664e624bae652eac2c2a568b236c1a03b71
                                                                                                • Instruction Fuzzy Hash: 55115C660DE155ADB643C8C4050D9F13F1BAA633703200043F71F6F643D2A549738FA5
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647955565.0000000005300000.00000040.00001000.00020000.00000000.sdmp, Offset: 05300000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5300000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 1525bb0363f318ce337cf42733b3c519067f59762bd88cc5baa4444dd1a5c83c
                                                                                                • Instruction ID: 192d85f38636264d07b07affb4f46b89e50c562389d1ce80946d82b909b5f990
                                                                                                • Opcode Fuzzy Hash: 1525bb0363f318ce337cf42733b3c519067f59762bd88cc5baa4444dd1a5c83c
                                                                                                • Instruction Fuzzy Hash: 3601E5E618D741BD9107D695466CBF67A2FA683770B741438F00BABE82E2900A49E131
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647955565.0000000005300000.00000040.00001000.00020000.00000000.sdmp, Offset: 05300000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5300000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 6c9c4c920ce948c6644ecd1921486711de4fbc3f5f3df5a45b8c301220bbf1c1
                                                                                                • Instruction ID: 27d6198224ff36079483929d79bdccf57f3ccdab9abb21b0a074af0a063ebbbc
                                                                                                • Opcode Fuzzy Hash: 6c9c4c920ce948c6644ecd1921486711de4fbc3f5f3df5a45b8c301220bbf1c1
                                                                                                • Instruction Fuzzy Hash: 6101D6E718D741BD410BD685066CBF77A2FB693770B742429F00BEBE82E2D00A45E131
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647706896.0000000005230000.00000040.00001000.00020000.00000000.sdmp, Offset: 05230000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5230000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: c62dad319f22707fe29297b99c4dfc64b506dd526c30b76baeba04053d9368b0
                                                                                                • Instruction ID: 307d71a2f64d63038a98d98511f67a6f015a80ac210cdc33a9077f7dc20f9fb9
                                                                                                • Opcode Fuzzy Hash: c62dad319f22707fe29297b99c4dfc64b506dd526c30b76baeba04053d9368b0
                                                                                                • Instruction Fuzzy Hash: 44017CEB1A81247DF60389852B688F7AA2EF8C37703308036F84291842E2C50A1931B1
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647955565.0000000005300000.00000040.00001000.00020000.00000000.sdmp, Offset: 05300000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5300000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: ec458f6df8534d6e7dfe1c92374f6404a5ef008d972c30997cddb36581b72ee3
                                                                                                • Instruction ID: cf7b2faaba631d07248c7f16285f33c84f5ae3b7d3c02bfcdd541ee7b15c1e05
                                                                                                • Opcode Fuzzy Hash: ec458f6df8534d6e7dfe1c92374f6404a5ef008d972c30997cddb36581b72ee3
                                                                                                • Instruction Fuzzy Hash: 36012BE618D741BD420AD65546AC7FB7A6FBAD3770B701038F407ABD82E3D04A49E130
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1648357966.0000000005440000.00000040.00001000.00020000.00000000.sdmp, Offset: 05440000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5440000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 4e05f11f39e35eca45398c5b655f8202e559dfa19bb621ef6420762107c12ad2
                                                                                                • Instruction ID: b150c64b2ba1358ccd32349484182761aaf92bb75467b84da2e6cd3a0dbd4136
                                                                                                • Opcode Fuzzy Hash: 4e05f11f39e35eca45398c5b655f8202e559dfa19bb621ef6420762107c12ad2
                                                                                                • Instruction Fuzzy Hash: FC11AB6608E298ADF683C4E4090DDF13F1BDA2737432404A3E70FAFA52C69105738F66
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647821318.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5290000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 3f1deb15dcaf970e11b844363a3fb069ba9b8e900f781eb506b776e03536e982
                                                                                                • Instruction ID: 018b7e9c8ce7dca8a287447c44951455951b640414d3d97ac518b0c11aef9c77
                                                                                                • Opcode Fuzzy Hash: 3f1deb15dcaf970e11b844363a3fb069ba9b8e900f781eb506b776e03536e982
                                                                                                • Instruction Fuzzy Hash: F2116B661BE34EEECE0FC569077CEBA7E27BD933343304067E4479AB82D2C4428552A1
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647706896.0000000005230000.00000040.00001000.00020000.00000000.sdmp, Offset: 05230000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5230000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: b3f76137606196305a32c9fd47b99c321bbd4c6b0b2ab8e54e22b2584a82f515
                                                                                                • Instruction ID: 6154dce574c24392c47885018ed786a74cf89b111e1afb8388831ec46ed4b3cb
                                                                                                • Opcode Fuzzy Hash: b3f76137606196305a32c9fd47b99c321bbd4c6b0b2ab8e54e22b2584a82f515
                                                                                                • Instruction Fuzzy Hash: 480119EB1A91257CB60385822B699F7AA3FE9C77307318437F943E0442A2C50E1931B2
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647821318.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5290000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 085650fb78ef427e7b80a50b58f1d03c8d21ba833803b6c6b3ca73ba62807b00
                                                                                                • Instruction ID: 28f4fbfedc339527e07811bc6b22d4cb081d52abd514e2f51b335242842ff03f
                                                                                                • Opcode Fuzzy Hash: 085650fb78ef427e7b80a50b58f1d03c8d21ba833803b6c6b3ca73ba62807b00
                                                                                                • Instruction Fuzzy Hash: CC01BDE607C24DEEDD0FC519467DABE6B27AE673383304066E5479B78291D042854162
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647821318.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5290000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: a0554d07014e5a7738391fc19151e702bc5e01c6a5527ebd34d23525ddaed8e3
                                                                                                • Instruction ID: 873695cb4336392fb29018e7ecb7811f712965cfcb2e342318e16b34f396213e
                                                                                                • Opcode Fuzzy Hash: a0554d07014e5a7738391fc19151e702bc5e01c6a5527ebd34d23525ddaed8e3
                                                                                                • Instruction Fuzzy Hash: 1B014ED71BD20EFD8C4FD486577DAB6292BBEA73387304061F6076AB4195C0439411A2
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1648357966.0000000005440000.00000040.00001000.00020000.00000000.sdmp, Offset: 05440000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5440000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 1155d2832419931de4b85dec039728aa2d4b3136e8c49c541569928c654e3345
                                                                                                • Instruction ID: b2a6b48d62cc6deaa7f0513ab54159ac8d04ddb2c4f4753ee17e236169361011
                                                                                                • Opcode Fuzzy Hash: 1155d2832419931de4b85dec039728aa2d4b3136e8c49c541569928c654e3345
                                                                                                • Instruction Fuzzy Hash: B80149661C9149AEB642D8C8490CDF63A1FDBA23747204413F70F6F642D3A189734EA4
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647821318.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5290000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 7228f769aadd6d1f2dbe225de971a56d97318fbcb136cb7d06992491edaa734b
                                                                                                • Instruction ID: d54fbd0fafc70bcc1ce7387b99b52cc11e54c43e4c72c4817b9eeac5a6dad59a
                                                                                                • Opcode Fuzzy Hash: 7228f769aadd6d1f2dbe225de971a56d97318fbcb136cb7d06992491edaa734b
                                                                                                • Instruction Fuzzy Hash: 92014ED617D21EFC9C4FD54A43BDA7A1927BDA733C3348061B107A7B429AC0439911A1
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647955565.0000000005300000.00000040.00001000.00020000.00000000.sdmp, Offset: 05300000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5300000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 1f050207ef7563f0b613dfd5eb116c01777ddfdfc6b8a7eed62255a11d53aceb
                                                                                                • Instruction ID: 074561e4611015287393b65283a049ecfb1cdaffbc718aee06a197581b138628
                                                                                                • Opcode Fuzzy Hash: 1f050207ef7563f0b613dfd5eb116c01777ddfdfc6b8a7eed62255a11d53aceb
                                                                                                • Instruction Fuzzy Hash: 7E0147E718D341BD4107D685566CBFB7A2FBA93770B701029F00BEBE82E2D00A49E130
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1648357966.0000000005440000.00000040.00001000.00020000.00000000.sdmp, Offset: 05440000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5440000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 86acd545b4ee3e7706c61973d98bea08de5acea41e3de6ddd0eae85cbdfb7a10
                                                                                                • Instruction ID: 151f701e19ac6df21fd1790cac4e022088760fbfc1d4d7c4b9bf698a22c8361f
                                                                                                • Opcode Fuzzy Hash: 86acd545b4ee3e7706c61973d98bea08de5acea41e3de6ddd0eae85cbdfb7a10
                                                                                                • Instruction Fuzzy Hash: B70128661C9109ADE141E8C8490C9F2371BDB623747200013F71F6F641C3B149B38FA4
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1648357966.0000000005440000.00000040.00001000.00020000.00000000.sdmp, Offset: 05440000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5440000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 9e681440c0e82e6ee2276fda27979209ca58422a30bb65553b9cb459a25945a6
                                                                                                • Instruction ID: 90d4017fff688b6de3cf36011b0e44b55d30c36985ae76801cabfd16ad87bca5
                                                                                                • Opcode Fuzzy Hash: 9e681440c0e82e6ee2276fda27979209ca58422a30bb65553b9cb459a25945a6
                                                                                                • Instruction Fuzzy Hash: B40147661CA219ADB542D8C8090C9F63A1FEB623B47304013F71F6F642D3E089735EA4
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647955565.0000000005300000.00000040.00001000.00020000.00000000.sdmp, Offset: 05300000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5300000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: b607197852fb23c259cb79007e70fb0188b1ea443f0ec6a8a94cfa3992e77d00
                                                                                                • Instruction ID: c099abe82185ddb2e5ff78cb108092fc9a0fe302d969caa27be4b596fdea8045
                                                                                                • Opcode Fuzzy Hash: b607197852fb23c259cb79007e70fb0188b1ea443f0ec6a8a94cfa3992e77d00
                                                                                                • Instruction Fuzzy Hash: 1BF0F4E618D341BC910AD6851A2CBFAAA2FFAC3730B701029F407E7982E2D00A49A031
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647955565.0000000005300000.00000040.00001000.00020000.00000000.sdmp, Offset: 05300000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5300000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: ae72a8e35c63c6e59c4b1d19f6a50d81d602b8ecde5d8cc3db16a8231a3b05a2
                                                                                                • Instruction ID: 0f4ec8276e04016fb382dab819b28f63dd7a360b30cd28ae62efa2fec26d4492
                                                                                                • Opcode Fuzzy Hash: ae72a8e35c63c6e59c4b1d19f6a50d81d602b8ecde5d8cc3db16a8231a3b05a2
                                                                                                • Instruction Fuzzy Hash: E8012B9714D741BC910BD655166CBFA7B2FA6837307741429E047EB9C3E2D00B49E130
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647955565.0000000005300000.00000040.00001000.00020000.00000000.sdmp, Offset: 05300000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5300000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 91326a789eac6ce5e833f4c7c8ba8b1a8e42b570f1712f90babbb16c00a564ef
                                                                                                • Instruction ID: 1d7df2913f70085714ae5e9f8217ba79462215f64656d3f8ed9ee6d1211a1022
                                                                                                • Opcode Fuzzy Hash: 91326a789eac6ce5e833f4c7c8ba8b1a8e42b570f1712f90babbb16c00a564ef
                                                                                                • Instruction Fuzzy Hash: F6F0F9D6189781ADA107D2552A3CBFBAA1FE692770B701025E807E7AC2E2D00649A031
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647821318.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5290000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 732ef5da629e8bd34bbae357ab733114d3f45c5d233971b7ece00b56ebfb7b16
                                                                                                • Instruction ID: e1eb9afae4cb7fccd2dbddb0a3b527d6d49c140e632bcb9aa49122925c71c05c
                                                                                                • Opcode Fuzzy Hash: 732ef5da629e8bd34bbae357ab733114d3f45c5d233971b7ece00b56ebfb7b16
                                                                                                • Instruction Fuzzy Hash: 41F0EBAA0BD00DFE8C0EC40A877CE7A353BBEA733833080A1F507ABB4196D0438510A1
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647706896.0000000005230000.00000040.00001000.00020000.00000000.sdmp, Offset: 05230000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5230000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 69c246793e0eb0c87c8d48e4c58b65ecc3fc3011181eaf50b9ec55d6996addb8
                                                                                                • Instruction ID: 24f99b93aa79bdfd8c03b3c6c0ca899d02b441dd845908f36f98ba6cf279306f
                                                                                                • Opcode Fuzzy Hash: 69c246793e0eb0c87c8d48e4c58b65ecc3fc3011181eaf50b9ec55d6996addb8
                                                                                                • Instruction Fuzzy Hash: 64F090EB0A81107DE74385952B685F6BB7EF9C73347308077F943A5442A2C40B197172
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647955565.0000000005300000.00000040.00001000.00020000.00000000.sdmp, Offset: 05300000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5300000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 87f26a0e6d52fd4da0aea1886ed59effd55ee780462ac4a2134c7c83638a0e37
                                                                                                • Instruction ID: 1da82d0043604f390b8f1e9b836547dacad7406f979ad7946fb63fe5d5f60bcb
                                                                                                • Opcode Fuzzy Hash: 87f26a0e6d52fd4da0aea1886ed59effd55ee780462ac4a2134c7c83638a0e37
                                                                                                • Instruction Fuzzy Hash: 7EF096E718D3957C9107E695176CBFAAE2FA5D7770B711029F806EB982E2C10B4DA031
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647821318.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5290000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 8baae59936c41263b53bd07576ae5d5098d9f4828a36fe5c9f23467f9521be76
                                                                                                • Instruction ID: 530eb0018fe3b03fbc46e85bab23c101b259bbd3ecaad11088e89b63d93de90b
                                                                                                • Opcode Fuzzy Hash: 8baae59936c41263b53bd07576ae5d5098d9f4828a36fe5c9f23467f9521be76
                                                                                                • Instruction Fuzzy Hash: 7AF059DA1BC15EFD8C4ED54A47BDFBA2A2BBDA73383308071F147AA74295C0838A1061
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647955565.0000000005300000.00000040.00001000.00020000.00000000.sdmp, Offset: 05300000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5300000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 8e729a98cb1f903e9f4f08ecc43128a30558a173289070f769cad0d8f4d38dba
                                                                                                • Instruction ID: 4a0ca69031f09a852fc039a05e8cd079bc658eadcd35e49e65a025453974b5bb
                                                                                                • Opcode Fuzzy Hash: 8e729a98cb1f903e9f4f08ecc43128a30558a173289070f769cad0d8f4d38dba
                                                                                                • Instruction Fuzzy Hash: 67F0BBDB28D3856C8107D6A51A6CBFA7F2FA993770B741069E0069B983E6C1074EA131
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647955565.0000000005300000.00000040.00001000.00020000.00000000.sdmp, Offset: 05300000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5300000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 588432585134c73237c78ace61873a5832411fd5d9c7088ac0b9e11c0b47ae12
                                                                                                • Instruction ID: 144ffa5268cde83cff1f1f24cf6385bc1ae7da4e2fcb0cf645b1e6cb976438c2
                                                                                                • Opcode Fuzzy Hash: 588432585134c73237c78ace61873a5832411fd5d9c7088ac0b9e11c0b47ae12
                                                                                                • Instruction Fuzzy Hash: B9F0E9A718D7456D8107E6962B6C7FEBB2EB9D3730B741039E016ABA82F7C1074DA131
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1648357966.0000000005440000.00000040.00001000.00020000.00000000.sdmp, Offset: 05440000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5440000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: d40577d24c586a180d0c1e33b8e1b111b81f6441216f5c39ae9ad718947eb533
                                                                                                • Instruction ID: 0aef04e3331e0fcf7e23833e179be15976b93e71b737ac300be72f4e9e61f35d
                                                                                                • Opcode Fuzzy Hash: d40577d24c586a180d0c1e33b8e1b111b81f6441216f5c39ae9ad718947eb533
                                                                                                • Instruction Fuzzy Hash: FCF0C8520C81899DF60199C51A1DDF6771BEA47B783200043E61E5F62382654A764E69
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1648357966.0000000005440000.00000040.00001000.00020000.00000000.sdmp, Offset: 05440000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5440000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 7ab2fbe88a2b1d2fd9a7890284fd8f2700814cc680b2f7a4e82e02e78acc309d
                                                                                                • Instruction ID: 0144809d22393fb6819fd9e11aafc751012acc50ec55568b659daff0cd7889dd
                                                                                                • Opcode Fuzzy Hash: 7ab2fbe88a2b1d2fd9a7890284fd8f2700814cc680b2f7a4e82e02e78acc309d
                                                                                                • Instruction Fuzzy Hash: 1CF0783208825ADEF311F9E8090C8F6769BEA173783200447F74B8F112C3A189B69B66
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647955565.0000000005300000.00000040.00001000.00020000.00000000.sdmp, Offset: 05300000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5300000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 7ddd17f8d65f234779cd8d6300d0f3b2ec289dab1ca884c85edb1d4c77cacc3b
                                                                                                • Instruction ID: 63992136f388d829c2bb529d13a5dc6eb2e86dd3e996f9ab6dbe179d98662f2f
                                                                                                • Opcode Fuzzy Hash: 7ddd17f8d65f234779cd8d6300d0f3b2ec289dab1ca884c85edb1d4c77cacc3b
                                                                                                • Instruction Fuzzy Hash: 44F0E2EB1882416C8107E6A55A5CAEA7E2EA9C3B30B711428E40697842F2C2460AA071
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647821318.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5290000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: e6ee5deeeedde038c5dbbf85668b6f986cbe1bc0a4aaee81741aea71196779c8
                                                                                                • Instruction ID: d7c13c2743a794060a83f929f0afd4b8d35fc62f0e702e06c4196fe7546bf47c
                                                                                                • Opcode Fuzzy Hash: e6ee5deeeedde038c5dbbf85668b6f986cbe1bc0a4aaee81741aea71196779c8
                                                                                                • Instruction Fuzzy Hash: 63F0279A07C10DEDDD0ED54A56BDFBA6A2BBEA733C7308062F1575AB4292C4438A1151
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647821318.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5290000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 3094a1a30494513654cb76458cb09f942dc322dccfa237eb15485694b49ca51b
                                                                                                • Instruction ID: c1ed1dd155a3f524bd8cf3614f10317a613c5e081816aeb83222438018f82384
                                                                                                • Opcode Fuzzy Hash: 3094a1a30494513654cb76458cb09f942dc322dccfa237eb15485694b49ca51b
                                                                                                • Instruction Fuzzy Hash: 2BE022DE1BC10CFC9C0EE58A23BDFB6692BADAB33C2304062F407A9F4151C4038A2028
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1648357966.0000000005440000.00000040.00001000.00020000.00000000.sdmp, Offset: 05440000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5440000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 5b5808cdd16cbeb1a7a7e808425fc2e3c5cd09d0048eee15c0653b76ad2ff0cc
                                                                                                • Instruction ID: 4b4b79347b4f99f99049a15e270f4081ef56c176f7a127aaf43cf822bbd80e94
                                                                                                • Opcode Fuzzy Hash: 5b5808cdd16cbeb1a7a7e808425fc2e3c5cd09d0048eee15c0653b76ad2ff0cc
                                                                                                • Instruction Fuzzy Hash: 95F0E2530D828DADB64288C91D1C9F5371FEA637B83200443F60E9F21282B58D725B79
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647821318.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5290000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 4e9d232192580a535ca996942a374e8b4389790a3264505e1dc028d715af4523
                                                                                                • Instruction ID: 767ff3c9eca3a80ac85b6aae0020b00ad9dba33efe1139cf3aece083c4397041
                                                                                                • Opcode Fuzzy Hash: 4e9d232192580a535ca996942a374e8b4389790a3264505e1dc028d715af4523
                                                                                                • Instruction Fuzzy Hash: 52F0276A57C1188EDD0AD93A12BE67EAA436E67338331007BD007DBB83C180835A6010
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647821318.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5290000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 29ffefd24f5eb7ad31cbaac2db926d0aad80e19f9a649891edd6e0d38852255f
                                                                                                • Instruction ID: be796ac26198cbfc46cfa8daf238b3d634d4bc50ad06c4b25054137fe56f2b7b
                                                                                                • Opcode Fuzzy Hash: 29ffefd24f5eb7ad31cbaac2db926d0aad80e19f9a649891edd6e0d38852255f
                                                                                                • Instruction Fuzzy Hash: 25E0269B43C00CE89C0EDA9713BEFB9AA03BCA733C3314466E50B68B0240C8038A6035
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647651751.0000000005200000.00000040.00001000.00020000.00000000.sdmp, Offset: 05200000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5200000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: b3c9d4bd6076c947bfe1e9070201ce799d17decadc91b57b671805ad91971f4d
                                                                                                • Instruction ID: 67dc77ef220224884495c59813484555af38b0cb198b1ba23bcb91df1863c6c6
                                                                                                • Opcode Fuzzy Hash: b3c9d4bd6076c947bfe1e9070201ce799d17decadc91b57b671805ad91971f4d
                                                                                                • Instruction Fuzzy Hash: C1E0269A7BB006683F01F4A0A50CFBF3A0BADB02B03E17923D049BC483E54068820085
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1648357966.0000000005440000.00000040.00001000.00020000.00000000.sdmp, Offset: 05440000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5440000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 42a27eac7d82381ad5fb38630f2ceba5520011b665f681c9aa37d6326de71706
                                                                                                • Instruction ID: 778cfa06d45100b474fa7dcc46210c8ca1726d26fe9d8eb78a28f3f8fb303083
                                                                                                • Opcode Fuzzy Hash: 42a27eac7d82381ad5fb38630f2ceba5520011b665f681c9aa37d6326de71706
                                                                                                • Instruction Fuzzy Hash: 89E026A70C418DAD768198D81E0C9FA620FDA867B83200503B62BAE25143B18DB39E79
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647821318.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5290000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 86ebefb01ab92809a43aeb51a66035eb587242b4b43f4c0c3ccc2144839dc4eb
                                                                                                • Instruction ID: 8d3d79f10436f046793e6fdd7b05af56d191eed9c1a60452a04052a3e433debd
                                                                                                • Opcode Fuzzy Hash: 86ebefb01ab92809a43aeb51a66035eb587242b4b43f4c0c3ccc2144839dc4eb
                                                                                                • Instruction Fuzzy Hash: DFE0C2AB97C11CE99C4DDA6B237FF799A13BCA737C2314476E64B69B0210C413996024
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647955565.0000000005300000.00000040.00001000.00020000.00000000.sdmp, Offset: 05300000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5300000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 46c89e813f98f134289772154914057fb28a30d53e14f7288270cb83b0e9bfd4
                                                                                                • Instruction ID: 85d2c7f1641fd9198f88b08891d990537ffbc3374d93115f778ce717be60773c
                                                                                                • Opcode Fuzzy Hash: 46c89e813f98f134289772154914057fb28a30d53e14f7288270cb83b0e9bfd4
                                                                                                • Instruction Fuzzy Hash: 36E0D8B225D38459C206AAB155A47DA3F579F81770F751088D045CF542E6924149E225
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647955565.0000000005300000.00000040.00001000.00020000.00000000.sdmp, Offset: 05300000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5300000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 77e5410d2ca83b230935c5025e31a5d4609bc9f03b1206a03ba9f0ad42d5329e
                                                                                                • Instruction ID: 37a7c71ff749f1bf9e62ef6642a4795fd3b97403111976e6422ff9f004ab96f6
                                                                                                • Opcode Fuzzy Hash: 77e5410d2ca83b230935c5025e31a5d4609bc9f03b1206a03ba9f0ad42d5329e
                                                                                                • Instruction Fuzzy Hash: 3CD0976120E38C82C30DFAF299C5BEC7B103F02371F2E02BDC0140EC869682420DE223

                                                                                                Non-executed Functions

                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647955565.0000000005300000.00000040.00001000.00020000.00000000.sdmp, Offset: 05300000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5300000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 9bda79985500d70b4e087061b97d570b0d58feac81f3a6a732a49d275a8e5e94
                                                                                                • Instruction ID: 21b8967bd71d8ca23bb07e85a20c15593e803993e35997a5e61a55ad0f5d09bf
                                                                                                • Opcode Fuzzy Hash: 9bda79985500d70b4e087061b97d570b0d58feac81f3a6a732a49d275a8e5e94
                                                                                                • Instruction Fuzzy Hash: 9C7139EB28C361BD715AC0862B7CBFB572FE1D67303B1A426F807D6D82E2D84A495471
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05A10000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5a10000_random.jbxd
                                                                                                Yara matches
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: d2c325caa5041e1a4c58aaabb7cee1978bfde62d2f6778094df9d63206e2f262
                                                                                                • Instruction ID: add265e4e169141ad3b8a76d21098f1cea21a71ff8da879ea0489d32efa1f158
                                                                                                • Opcode Fuzzy Hash: d2c325caa5041e1a4c58aaabb7cee1978bfde62d2f6778094df9d63206e2f262
                                                                                                • Instruction Fuzzy Hash: D97115B96156009FD784CF2AD580A16BBE1FF8C318774DAADD4488F216D332E853CB91
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05A10000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5a10000_random.jbxd
                                                                                                Yara matches
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 0f5a726f139a164966b9607449edb8e34850dbc01c64d8e6139ee98f00e7b444
                                                                                                • Instruction ID: 585fe4ff8a0b9984c34d4bba064179c5eed92c866de26ff02bde0154a49ee831
                                                                                                • Opcode Fuzzy Hash: 0f5a726f139a164966b9607449edb8e34850dbc01c64d8e6139ee98f00e7b444
                                                                                                • Instruction Fuzzy Hash: C74102B170D1014F8B4D4F1CA4110193D93EF5930134544BD714BC7394CA304C40951C
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1648579077.0000000005A10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05A10000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5a10000_random.jbxd
                                                                                                Yara matches
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 719b55bb62013a1d027927b69ac79588e4a442b0c625a628f247d03920ca971a
                                                                                                • Instruction ID: 393672f2d7580d27a41b82497b363384aa994e235a9693099cf71a4800771d91
                                                                                                • Opcode Fuzzy Hash: 719b55bb62013a1d027927b69ac79588e4a442b0c625a628f247d03920ca971a
                                                                                                • Instruction Fuzzy Hash: 2941FB755541089FD300DF1CED80A17B3E6EF9C304F25D528E498CB226D236E962DBA1
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000001.00000002.1647764860.0000000005260000.00000040.00001000.00020000.00000000.sdmp, Offset: 05260000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_1_2_5260000_random.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 16fe974b377831b31bf291f8d970ec8353404550e47a5fdb84fe7db03b7594e9
                                                                                                • Instruction ID: 4a9cf6444974b4efb9aec21d613c69789afcd88e0947c80a0380c7f966826b74
                                                                                                • Opcode Fuzzy Hash: 16fe974b377831b31bf291f8d970ec8353404550e47a5fdb84fe7db03b7594e9
                                                                                                • Instruction Fuzzy Hash: AE01D4FB22C1516D7106C2867B9CEFB37AEE9D6330331842BF046C6502DAA5998A5532