Edit tour

Windows Analysis Report
random(2).exe

Overview

General Information

Sample name:	random(2).exe
Analysis ID:	1643067
MD5:	5e941e7c271e85093cb8344fb7cab50b
SHA1:	7a1f977cfd43da7dec3acfd45fcfea91f3acb76c
SHA256:	51c583db2595a3aefa45efaa70c8f0cc1394c18549746bc9fe654fedb9d17e57
Tags:	176-113-115-7exeuser-JAMESWT_MHT
Infos:

Detection

Vidar

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Attempt to bypass Chrome Application-Bound Encryption

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Vidar stealer

Hides threads from debuggers

Joe Sandbox ML detected suspicious sample

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Abnormal high CPU Usage

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Entry point lies outside standard sections

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Browser Started with Remote Debugging

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

random(2).exe (PID: 6980 cmdline: "C:\Users\user\Desktop\random(2).exe" MD5: 5E941E7C271E85093CB8344FB7CAB50B)

chrome.exe (PID: 7804 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 8048 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2296,i,9997688068787143346,17471011568796092826,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2464 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 3436 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 4968 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 512 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 1532 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6768 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 4056 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1130116827.0000000000B79000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000003.1152734556.0000000000B76000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000003.1171301147.0000000000B77000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: random(2).exe PID: 6980	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: random(2).exe PID: 6980	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\random(2).exe", ParentImage: C:\Users\user\Desktop\random(2).exe, ParentProcessId: 6980, ParentProcessName: random(2).exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", ProcessId: 7804, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-19T14:00:17.957230+0100	2044247	1	Malware Command and Control Activity Detected	78.47.63.132	443	192.168.2.10	49685	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-19T14:00:20.590469+0100	2051831	1	Malware Command and Control Activity Detected	78.47.63.132	443	192.168.2.10	49686	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-19T14:00:20.590290+0100	2049087	1	A Network Trojan was detected	192.168.2.10	49686	78.47.63.132	443	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-19T14:00:28.067428+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.10	49694	78.47.63.132	443	TCP
2025-03-19T14:02:16.338105+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.10	49699	78.47.63.132	443	TCP
2025-03-19T14:02:16.739083+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.10	49700	78.47.63.132	443	TCP
2025-03-19T14:02:17.804395+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.10	49701	78.47.63.132	443	TCP
2025-03-19T14:02:19.840485+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.10	49702	78.47.63.132	443	TCP

ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-19T14:02:16.739083+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.10	49700	78.47.63.132	443	TCP
2025-03-19T14:02:17.804395+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.10	49701	78.47.63.132	443	TCP
2025-03-19T14:02:19.840485+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.10	49702	78.47.63.132	443	TCP

ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-19T14:00:14.506040+0100	2859378	1	Malware Command and Control Activity Detected	192.168.2.10	49683	78.47.63.132	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: random(2).exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: random(2).exe	Virustotal: Detection: 50%			Perma Link
Source: random(2).exe	ReversingLabs: Detection: 58%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: random(2).exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.10:49681 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 78.47.63.132:443 -> 192.168.2.10:49682 version: TLS 1.2

Source: C:\Users\user\Desktop\random(2).exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 38MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859378 - Severity 1 - ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2 : 192.168.2.10:49683 -> 78.47.63.132:443
Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1 : 192.168.2.10:49686 -> 78.47.63.132:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.10:49700 -> 78.47.63.132:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.10:49700 -> 78.47.63.132:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.10:49694 -> 78.47.63.132:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.10:49702 -> 78.47.63.132:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.10:49702 -> 78.47.63.132:443
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 78.47.63.132:443 -> 192.168.2.10:49686
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.10:49699 -> 78.47.63.132:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.10:49701 -> 78.47.63.132:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.10:49701 -> 78.47.63.132:443
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 78.47.63.132:443 -> 192.168.2.10:49685

Source: global traffic

HTTP traffic detected: GET /g_etcontent HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 78.47.63.132 78.47.63.132

Source: Joe Sandbox View

ASN Name: HETZNER-ASDE HETZNER-ASDE

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /g_etcontent HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:135.0) Firefox/135.0Host: y.p.formaxprime.co.ukConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJe2yQEIo7bJAQipncoBCJr0ygEIlKHLAQiKo8sBCIWgzQEI/aXOAQiB1s4BCMHYzgEIydzOAQjg4M4BCOXjzgEIr+TOAQjI5M4BCN/kzgEIi+XOAQiO5c4BSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJe2yQEIo7bJAQipncoBCJr0ygEIlKHLAQiKo8sBCIWgzQEI/aXOAQiB1s4BCMHYzgEIydzOAQjg4M4BCOXjzgEIr+TOAQjI5M4BCN/kzgEIi+XOAQiO5c4BSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: chrome.exe, 0000000C.00000003.2419053610.00003CCC00328000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <!--_html_template_end_-->`}const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends CrLitElement{constructor(){super(...arguments);this.url={url:""}}static get is(){return"ntp-doodle-share-dialog"}static get styles(){return getCss$2()}render(){return getHtml$2.bind(this)()}static get properties(){return{title:{type:String},url:{type:Object}}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.fire("share",channel)}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);let instance$3=null;function getCss$1(){return instance$3\|\|(instance$3=[...[getCss$4()],css`:host{--ntp-logo-height:168px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#doodle{position:relative}#shareButton{background-color:var(--color-new-tab-page-doodle-share-button-background,none);border:none;height:32px;min-width:32px;padding:0;position:absolute;width:32px;bottom:0}:host-context([dir=ltr]) #shareButton{right:-40px}:host-context([dir=rtl]) #shareButton{left:-40px}#shareButtonIcon{width:18px;height:18px;margin:7px;vertical-align:bottom;mask-image:url(chrome://new-tab-page/icons/share_unfilled.svg);background-color:var(--color-new-tab-page-doodle-share-button-i
Source: chrome.exe, 0000000C.00000003.2419053610.00003CCC00328000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <!--_html_template_end_-->`}const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends CrLitElement{constructor(){super(...arguments);this.url={url:""}}static get is(){return"ntp-doodle-share-dialog"}static get styles(){return getCss$2()}render(){return getHtml$2.bind(this)()}static get properties(){return{title:{type:String},url:{type:Object}}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.fire("share",channel)}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);let instance$3=null;function getCss$1(){return instance$3\|\|(instance$3=[...[getCss$4()],css`:host{--ntp-logo-height:168px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#doodle{position:relative}#shareButton{background-color:var(--color-new-tab-page-doodle-share-button-background,none);border:none;height:32px;min-width:32px;padding:0;position:absolute;width:32px;bottom:0}:host-context([dir=ltr]) #shareButton{right:-40px}:host-context([dir=rtl]) #shareButton{left:-40px}#shareButtonIcon{width:18px;height:18px;margin:7px;vertical-align:bottom;mask-image:url(chrome://new-tab-page/icons/share_unfilled.svg);background-color:var(--color-new-tab-page-doodle-share-button-i

Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: y.p.formaxprime.co.uk
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----90r90zuknop8ym7qiwbsUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:135.0) Firefox/135.0Host: y.p.formaxprime.co.ukContent-Length: 256Connection: Keep-AliveCache-Control: no-cache

Source: chrome.exe, 0000000C.00000002.6037129593.00003CCC0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 0000000C.00000002.5846593062.00003CCC000DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.chrome.com/docs/extensions/how-to/distribute/install-extensions)
Source: chrome.exe, 0000000C.00000002.5817119523.00003CCC000A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: chrome.exe, 0000000C.00000002.2655107307.00000249DAA8D000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUw
Source: chrome.exe, 0000000C.00000002.2655107307.00000249DAA8D000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://www.google.com/update2/response
Source: chrome.exe, 0000000C.00000002.6071108728.00003CCC00234000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 0000000C.00000002.5785927082.00003CCC0003C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 0000000C.00000002.6037129593.00003CCC0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 0000000C.00000002.6071108728.00003CCC00234000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/AccountChooser
Source: chrome.exe, 0000000C.00000002.6037129593.00003CCC0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 0000000C.00000002.6071108728.00003CCC00234000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 0000000C.00000002.6071108728.00003CCC00234000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 0000000C.00000002.6037129593.00003CCC0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 0000000C.00000002.6037129593.00003CCC0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 0000000C.00000002.6206613229.00003CCC002D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport
Source: chrome.exe, 0000000C.00000002.6206613229.00003CCC002D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/fine-allowlist
Source: chrome.exe, 0000000C.00000002.6037129593.00003CCC0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 0000000C.00000002.6071108728.00003CCC00234000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 0000000C.00000002.6071108728.00003CCC00234000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 0000000C.00000002.6071108728.00003CCC00234000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 0000000C.00000002.6071108728.00003CCC00234000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 0000000C.00000002.6071108728.00003CCC00234000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 0000000C.00000002.6071108728.00003CCC00234000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 0000000C.00000002.6071108728.00003CCC00234000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 0000000C.00000002.6071108728.00003CCC00234000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 0000000C.00000002.5829878346.00003CCC000B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chrome.exe, 0000000C.00000002.5829878346.00003CCC000B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxABata
Source: chrome.exe, 0000000C.00000002.6037129593.00003CCC0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 0000000C.00000002.6037129593.00003CCC0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 0000000C.00000002.6071108728.00003CCC00234000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/samlredirect
Source: chrome.exe, 0000000C.00000002.6071108728.00003CCC00234000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 0000000C.00000002.5877330232.00003CCC00138000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: wt26ph.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&ci=1696497267574.12791&key=1696497267400700
Source: wt26ph.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&ci=1696497267574.12791&key=1696497267400700002.1&cta
Source: chrome.exe, 0000000C.00000003.2419271192.00003CCC0176C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2418998130.00003CCC0174C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://calendar.google.com
Source: chrome.exe, 0000000C.00000003.2415297744.00003CCC01614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 0000000C.00000002.2655346363.00000249DACD7000.00000004.08000000.00040000.00000000.sdmp, chrome.exe, 0000000C.00000002.6071108728.00003CCC00234000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 0000000C.00000003.2415004575.00003CCC01544000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2415297744.00003CCC01614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 0000000C.00000003.2375705245.00003CC800514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.5727830719.00003CC80073C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 0000000C.00000003.2375705245.00003CC800514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.5727830719.00003CC80073C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 0000000C.00000003.2376583988.00003CC8005DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2376965313.00003CC8005E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 0000000C.00000003.2375705245.00003CC800514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.5727830719.00003CC80073C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 0000000C.00000002.6071108728.00003CCC00234000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 0000000C.00000002.6071108728.00003CCC00234000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 0000000C.00000002.6005702865.00003CCC001AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 0000000C.00000002.6071108728.00003CCC00234000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 0000000C.00000003.2368131775.00005790000DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2440856608.00001D70000DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000002.2441975397.0000019852A38000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2910763752.00004AC8000DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2913446931.00000151EF2A9000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.3483222228.00001028000DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.3484917203.000002C188C08000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.3617596899.00004718000DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.3949682834.00006E08000DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.4389139326.00003DE0000DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.4390386867.000001E34F488000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 0000000C.00000002.6005702865.00003CCC001AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.5946881406.00003CCC00174000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.6071108728.00003CCC00234000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 0000000C.00000002.6071108728.00003CCC00234000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 0000000C.00000002.6071108728.00003CCC00234000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: wt26ph.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/5b4DH7KHAf2n_mNaLjNi1-UAoKmM9rhqaA9w7FyznHo.10943.jpg
Source: wt26ph.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: chrome.exe, 0000000C.00000002.6598026417.00003CCC00550000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/gws/none
Source: chrome.exe, 0000000C.00000003.2375705245.00003CC800514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.5727830719.00003CC80073C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview2K
Source: chrome.exe, 0000000C.00000003.2420626371.00003CCC01898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2420162161.00003CCC01848000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2420798445.00003CCC017AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.google.com/icons?selected=Material
Source: chrome.exe, 0000000C.00000003.2375705245.00003CC800514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.5727830719.00003CC80073C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/glic/intro?20
Source: chrome.exe, 0000000C.00000003.2375705245.00003CC800514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.5727830719.00003CC80073C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/glic2
Source: chrome.exe, 0000000C.00000003.2376965313.00003CC8005E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 0000000C.00000003.2375705245.00003CC800514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.5727830719.00003CC80073C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 0000000C.00000003.2376583988.00003CC8005DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2376965313.00003CC8005E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 0000000C.00000003.2375705245.00003CC800514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.5727830719.00003CC80073C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 0000000C.00000003.2376583988.00003CC8005DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2376965313.00003CC8005E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 0000000C.00000003.2376583988.00003CC8005DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2376965313.00003CC8005E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Pre
Source: chrome.exe, 0000000C.00000003.2376965313.00003CC8005E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: chrome.exe, 0000000C.00000002.5771387251.00003CCC00004000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.6071108728.00003CCC00234000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 0000000C.00000003.2375705245.00003CC800514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.5727830719.00003CC80073C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: wt26ph.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqrfQHr4pbW4ZbWfpbY7ReNxR3UIG8zInwYIFIVs9eYi
Source: chrome.exe, 0000000C.00000003.2419271192.00003CCC0176C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/gen204
Source: chrome.exe, 0000000C.00000002.6071108728.00003CCC00234000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 0000000C.00000003.2375705245.00003CC800514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.5727830719.00003CC80073C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email?utm_source=chrome2B
Source: chrome.exe, 0000000C.00000002.6071108728.00003CCC00234000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 0000000C.00000002.6071108728.00003CCC00234000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: chrome.exe, 0000000C.00000002.5805027972.00003CCC00068000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 0000000C.00000003.2414667869.00003CCC00B50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 0000000C.00000003.2414667869.00003CCC00B50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 0000000C.00000002.5877330232.00003CCC00138000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 0000000C.00000003.2414667869.00003CCC00B50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 0000000C.00000002.6005702865.00003CCC001AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2414667869.00003CCC00B50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 0000000C.00000003.2414667869.00003CCC00B50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 0000000C.00000002.6071108728.00003CCC00234000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: chrome.exe, 0000000C.00000003.2419271192.00003CCC0176C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2418998130.00003CCC0174C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.office.com/calendar/
Source: chrome.exe, 0000000C.00000002.6071108728.00003CCC00234000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://people.googleapis.com/
Source: chrome.exe, 0000000C.00000002.6598026417.00003CCC00550000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 0000000C.00000002.5864508558.00003CCC0011C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.5817119523.00003CCC00094000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyA2KlwBX3mkFo30om9LU
Source: chrome.exe, 0000000C.00000002.6071108728.00003CCC00234000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 0000000C.00000003.2375705245.00003CC800514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.5727830719.00003CC80073C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comb
Source: chrome.exe, 0000000C.00000002.6206613229.00003CCC002D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.google.cmanager.com
Source: chrome.exe, 0000000C.00000002.5877330232.00003CCC00138000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: random(2).exe, 00000000.00000003.1061579899.00000000047F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199832267488
Source: random(2).exe, 00000000.00000003.1061579899.00000000047F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199832267488dqu220Mozilla/5.0
Source: random(2).exe, 00000000.00000003.1079632033.0000000000B79000.00000004.00000020.00020000.00000000.sdmp, random(2).exe, 00000000.00000003.1079632033.0000000000B6B000.00000004.00000020.00020000.00000000.sdmp, random(2).exe, 00000000.00000003.1079609497.0000000000BB3000.00000004.00000020.00020000.00000000.sdmp, random(2).exe, 00000000.00000003.1061579899.00000000047F0000.00000004.00001000.00020000.00000000.sdmp, random(2).exe, 00000000.00000003.1079632033.0000000000B73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/g_etcontent
Source: random(2).exe, 00000000.00000003.1061579899.00000000047F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://t.me/g_etcontentdqu220Mozilla/5.0
Source: chrome.exe, 0000000C.00000002.6071108728.00003CCC00234000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tasks.googleapis.com/
Source: random(2).exe, 00000000.00000003.1079632033.0000000000B79000.00000004.00000020.00020000.00000000.sdmp, random(2).exe, 00000000.00000003.1079632033.0000000000B6B000.00000004.00000020.00020000.00000000.sdmp, random(2).exe, 00000000.00000003.1096240844.0000000000B76000.00000004.00000020.00020000.00000000.sdmp, random(2).exe, 00000000.00000003.1110484696.0000000000B79000.00000004.00000020.00020000.00000000.sdmp, random(2).exe, 00000000.00000003.1079632033.0000000000B73000.00000004.00000020.00020000.00000000.sdmp, random(2).exe, 00000000.00000003.1079632033.0000000000BB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: wt26ph.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15e498ec2b39921665a1fbc954bff40a8106629178eadc64
Source: chrome.exe, 0000000C.00000002.5877330232.00003CCC00138000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 0000000C.00000002.5877330232.00003CCC00138000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: chrome.exe, 0000000C.00000003.2415297744.00003CCC01614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 0000000C.00000003.2375705245.00003CC800514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.5727830719.00003CC80073C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/go-mobile/?ios-campaign=desktop-chr-ntp&android-campaign=desktop-chr-n
Source: chrome.exe, 0000000C.00000002.5871320655.00003CCC00128000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl
Source: chrome.exe, 0000000C.00000003.2375705245.00003CC800514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.5727830719.00003CC80073C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 0000000C.00000002.6585183116.00003CCC0053D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 0000000C.00000002.5877330232.00003CCC00138000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.comAccess-Control-Allow-Credentials:
Source: chrome.exe, 0000000C.00000002.6037129593.00003CCC0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 0000000C.00000003.2375705245.00003CC800514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.5727830719.00003CC80073C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 0000000C.00000002.6037129593.00003CCC0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 0000000C.00000002.6037129593.00003CCC0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 0000000C.00000002.6037129593.00003CCC0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 0000000C.00000002.6037129593.00003CCC0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 0000000C.00000002.5877330232.00003CCC00138000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 0000000C.00000002.5877330232.00003CCC00138000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: wt26ph.0.dr	String found in binary or memory: https://www.marriott.com/default.mi?utm_source=admarketplace&utm_medium=cpc&utm_campaign=Marriott_Pr
Source: random(2).exe, 00000000.00000003.1079632033.0000000000BB0000.00000004.00000020.00020000.00000000.sdmp, random(2).exe, 00000000.00000003.2325141904.0000000005538000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://y.p.formaxprime.co.uk
Source: random(2).exe, 00000000.00000003.1096240844.0000000000B76000.00000004.00000020.00020000.00000000.sdmp, random(2).exe, 00000000.00000003.1152734556.0000000000B76000.00000004.00000020.00020000.00000000.sdmp, random(2).exe, 00000000.00000003.1110484696.0000000000B79000.00000004.00000020.00020000.00000000.sdmp, random(2).exe, 00000000.00000003.1171301147.0000000000B77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://y.p.formaxprime.co.uk/
Source: random(2).exe, 00000000.00000003.1152734556.0000000000B76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://y.p.formaxprime.co.uk//
Source: random(2).exe, 00000000.00000003.1171301147.0000000000B77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://y.p.formaxprime.co.uk/5
Source: random(2).exe, 00000000.00000003.1130116827.0000000000B79000.00000004.00000020.00020000.00000000.sdmp, random(2).exe, 00000000.00000003.1152734556.0000000000B76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://y.p.formaxprime.co.uk/G
Source: random(2).exe, 00000000.00000003.1130116827.0000000000B79000.00000004.00000020.00020000.00000000.sdmp, random(2).exe, 00000000.00000003.1096240844.0000000000B76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://y.p.formaxprime.co.uk/a
Source: random(2).exe, 00000000.00000003.1152734556.0000000000B76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://y.p.formaxprime.co.uk/j
Source: random(2).exe, 00000000.00000003.1130116827.0000000000B79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://y.p.formaxprime.co.uk/m
Source: random(2).exe, 00000000.00000003.2325141904.0000000005538000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://y.p.formaxprime.co.ukK
Source: random(2).exe, 00000000.00000003.2325141904.0000000005538000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://y.p.formaxprime.co.ukZ
Source: random(2).exe, 00000000.00000003.2325141904.0000000005538000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://y.p.formaxprime.co.ukb
Source: random(2).exe, 00000000.00000003.2325141904.0000000005538000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://y.p.formaxprime.co.ukg
Source: random(2).exe, 00000000.00000003.2325141904.0000000005538000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://y.p.formaxprime.co.ukq
Source: random(2).exe, 00000000.00000003.2325141904.0000000005538000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://y.p.formaxprime.co.ukv

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49686
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49684
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49682
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49681
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49682 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49681 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.10:49681 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 78.47.63.132:443 -> 192.168.2.10:49682 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: random(2).exe	Static PE information: section name:
Source: random(2).exe	Static PE information: section name: .idata
Source: random(2).exe	Static PE information: section name:

Source: C:\Users\user\Desktop\random(2).exe

Process Stats: CPU usage > 49%

Source: random(2).exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: random(2).exe	Static PE information: Section: ZLIB complexity 0.9982289459745762
Source: random(2).exe	Static PE information: Section: xyhrtgkn ZLIB complexity 0.9948176319648094

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@34/1@4/4

Source: C:\Users\user\Desktop\random(2).exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\F0CK4TZV.htm

Jump to behavior

Source: C:\Users\user\Desktop\random(2).exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: random(2).exe	Virustotal: Detection: 50%
Source: random(2).exe	ReversingLabs: Detection: 58%

Source: unknown	Process created: C:\Users\user\Desktop\random(2).exe "C:\Users\user\Desktop\random(2).exe"
Source: C:\Users\user\Desktop\random(2).exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2296,i,9997688068787143346,17471011568796092826,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2464 /prefetch:3
Source: C:\Users\user\Desktop\random(2).exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Users\user\Desktop\random(2).exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Users\user\Desktop\random(2).exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Users\user\Desktop\random(2).exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Users\user\Desktop\random(2).exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Users\user\Desktop\random(2).exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Users\user\Desktop\random(2).exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2296,i,9997688068787143346,17471011568796092826,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2464 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\random(2).exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Section loaded: ntmarta.dll	Jump to behavior

Source: C:\Users\user\Desktop\random(2).exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: random(2).exe

Static file information: File size 1822720 > 1048576

Source: random(2).exe

Static PE information: Raw size of xyhrtgkn is bigger than: 0x100000 < 0x1aa400

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random(2).exe

Static PE information: real checksum: 0x1bd743 should be: 0x1be5cf

Source: random(2).exe	Static PE information: section name:
Source: random(2).exe	Static PE information: section name: .idata
Source: random(2).exe	Static PE information: section name:
Source: random(2).exe	Static PE information: section name: xyhrtgkn
Source: random(2).exe	Static PE information: section name: atwyfmcm
Source: random(2).exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\random(2).exe	Code function: 0_3_0493DFF7 push ecx; iretd	0_3_0493E074
Source: C:\Users\user\Desktop\random(2).exe	Code function: 0_3_0493DFF7 push ecx; iretd	0_3_0493E074
Source: C:\Users\user\Desktop\random(2).exe	Code function: 0_3_0493DFF7 push ecx; iretd	0_3_0493E074
Source: C:\Users\user\Desktop\random(2).exe	Code function: 0_3_0493DFF7 push ecx; iretd	0_3_0493E074
Source: C:\Users\user\Desktop\random(2).exe	Code function: 0_3_0493DFF7 push ecx; iretd	0_3_0493E074
Source: C:\Users\user\Desktop\random(2).exe	Code function: 0_3_04931521 push eax; iretd	0_3_04931525
Source: C:\Users\user\Desktop\random(2).exe	Code function: 0_3_04931521 push eax; iretd	0_3_04931525
Source: C:\Users\user\Desktop\random(2).exe	Code function: 0_3_04931521 push eax; iretd	0_3_04931525
Source: C:\Users\user\Desktop\random(2).exe	Code function: 0_3_04931521 push eax; iretd	0_3_04931525
Source: C:\Users\user\Desktop\random(2).exe	Code function: 0_3_04931521 push eax; iretd	0_3_04931525
Source: C:\Users\user\Desktop\random(2).exe	Code function: 0_3_0493DFF7 push ecx; iretd	0_3_0493E074
Source: C:\Users\user\Desktop\random(2).exe	Code function: 0_3_0493DFF7 push ecx; iretd	0_3_0493E074
Source: C:\Users\user\Desktop\random(2).exe	Code function: 0_3_0493DFF7 push ecx; iretd	0_3_0493E074
Source: C:\Users\user\Desktop\random(2).exe	Code function: 0_3_0493DFF7 push ecx; iretd	0_3_0493E074
Source: C:\Users\user\Desktop\random(2).exe	Code function: 0_3_0493DFF7 push ecx; iretd	0_3_0493E074
Source: C:\Users\user\Desktop\random(2).exe	Code function: 0_3_04931521 push eax; iretd	0_3_04931525
Source: C:\Users\user\Desktop\random(2).exe	Code function: 0_3_04931521 push eax; iretd	0_3_04931525
Source: C:\Users\user\Desktop\random(2).exe	Code function: 0_3_04931521 push eax; iretd	0_3_04931525
Source: C:\Users\user\Desktop\random(2).exe	Code function: 0_3_04931521 push eax; iretd	0_3_04931525
Source: C:\Users\user\Desktop\random(2).exe	Code function: 0_3_04931521 push eax; iretd	0_3_04931525
Source: C:\Users\user\Desktop\random(2).exe	Code function: 0_3_0493DFF7 push ecx; iretd	0_3_0493E074
Source: C:\Users\user\Desktop\random(2).exe	Code function: 0_3_0493DFF7 push ecx; iretd	0_3_0493E074
Source: C:\Users\user\Desktop\random(2).exe	Code function: 0_3_0493DFF7 push ecx; iretd	0_3_0493E074
Source: C:\Users\user\Desktop\random(2).exe	Code function: 0_3_0493DFF7 push ecx; iretd	0_3_0493E074
Source: C:\Users\user\Desktop\random(2).exe	Code function: 0_3_0493DFF7 push ecx; iretd	0_3_0493E074
Source: C:\Users\user\Desktop\random(2).exe	Code function: 0_3_04931521 push eax; iretd	0_3_04931525
Source: C:\Users\user\Desktop\random(2).exe	Code function: 0_3_04931521 push eax; iretd	0_3_04931525
Source: C:\Users\user\Desktop\random(2).exe	Code function: 0_3_04931521 push eax; iretd	0_3_04931525
Source: C:\Users\user\Desktop\random(2).exe	Code function: 0_3_04931521 push eax; iretd	0_3_04931525
Source: C:\Users\user\Desktop\random(2).exe	Code function: 0_3_04931521 push eax; iretd	0_3_04931525
Source: C:\Users\user\Desktop\random(2).exe	Code function: 0_3_0493DFF7 push ecx; iretd	0_3_0493E074

Source: random(2).exe	Static PE information: section name: entropy: 7.97802160630939
Source: random(2).exe	Static PE information: section name: xyhrtgkn entropy: 7.955289387133198

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\random(2).exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Window searched: window name: Regmonclass	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\random(2).exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 42D0F5 second address: 42D110 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F29453582E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 42C9C5 second address: 42C9CF instructions: 0x00000000 rdtsc 0x00000002 jp 00007F294453553Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5AB975 second address: 5AB98E instructions: 0x00000000 rdtsc 0x00000002 jne 00007F29453582D6h 0x00000008 jmp 00007F29453582DAh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 push ecx 0x00000011 push esi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5AA9B1 second address: 5AA9B6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5AAC86 second address: 5AAC8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5AAC8A second address: 5AACBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2944535544h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F2944535540h 0x00000010 popad 0x00000011 push eax 0x00000012 push esi 0x00000013 push eax 0x00000014 pop eax 0x00000015 pop esi 0x00000016 push edi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5AAF57 second address: 5AAF5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5AAF5B second address: 5AAF67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5AAF67 second address: 5AAF7B instructions: 0x00000000 rdtsc 0x00000002 je 00007F29453582D6h 0x00000008 jmp 00007F29453582DAh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5AAF7B second address: 5AAFA1 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F294453553Ah 0x00000008 jmp 00007F294453553Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jne 00007F294453553Ah 0x00000016 push eax 0x00000017 pop eax 0x00000018 push edi 0x00000019 pop edi 0x0000001a push ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5AAFA1 second address: 5AAFE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F29453582DBh 0x00000009 pop ebx 0x0000000a push ecx 0x0000000b jmp 00007F29453582E2h 0x00000010 jmp 00007F29453582E4h 0x00000015 pop ecx 0x00000016 js 00007F29453582DCh 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5AD8F0 second address: 5AD8FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F2944535536h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5AD8FA second address: 5AD909 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5AD909 second address: 5AD918 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F294453553Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5AD918 second address: 5AD91E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5AD91E second address: 5AD922 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5AD922 second address: 5AD932 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c pushad 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5AD932 second address: 5AD93F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007F2944535536h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5AD93F second address: 5AD994 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a jmp 00007F29453582E0h 0x0000000f push eax 0x00000010 jmp 00007F29453582E3h 0x00000015 pop eax 0x00000016 popad 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b pushad 0x0000001c js 00007F29453582ECh 0x00000022 jmp 00007F29453582E6h 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5AD994 second address: 5AD998 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5AD998 second address: 5AD99C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5ADB00 second address: 5ADB04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5ADB04 second address: 5ADB0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5ADB0A second address: 5ADB0F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5ADB0F second address: 5ADB48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c stc 0x0000000d jp 00007F29453582DBh 0x00000013 push 00000000h 0x00000015 mov dx, si 0x00000018 push 867025AEh 0x0000001d pushad 0x0000001e jmp 00007F29453582E3h 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5ADB48 second address: 5ADB4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5ADB4E second address: 5ADBA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 add dword ptr [esp], 798FDAD2h 0x0000000d or dword ptr [ebp+122D1964h], edx 0x00000013 jmp 00007F29453582E7h 0x00000018 push 00000003h 0x0000001a jc 00007F29453582DCh 0x00000020 xor esi, dword ptr [ebp+122D195Ch] 0x00000026 push 00000000h 0x00000028 mov dword ptr [ebp+122D355Ah], eax 0x0000002e push 00000003h 0x00000030 mov edi, dword ptr [ebp+122D3892h] 0x00000036 push 970B4C30h 0x0000003b jo 00007F29453582E0h 0x00000041 pushad 0x00000042 pushad 0x00000043 popad 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5ADC80 second address: 5ADC84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5ADC84 second address: 5ADCE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007F29453582D8h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 0000001Bh 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 xor edx, dword ptr [ebp+122D2116h] 0x0000002a push 00000000h 0x0000002c push ebx 0x0000002d mov ecx, dword ptr [ebp+122D370Ah] 0x00000033 pop edi 0x00000034 call 00007F29453582D9h 0x00000039 jmp 00007F29453582E0h 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 jng 00007F29453582D8h 0x00000047 push eax 0x00000048 pop eax 0x00000049 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5ADCE5 second address: 5ADD16 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push edi 0x0000000f push esi 0x00000010 jmp 00007F2944535548h 0x00000015 pop esi 0x00000016 pop edi 0x00000017 mov eax, dword ptr [eax] 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5ADD16 second address: 5ADD1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5ADD1A second address: 5ADD1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5CE61E second address: 5CE62A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F29453582D6h 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5CE7A0 second address: 5CE7A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5CE7A9 second address: 5CE7C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29453582E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5CE931 second address: 5CE935 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5CEC0E second address: 5CEC12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5CEC12 second address: 5CEC16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5CEC16 second address: 5CEC22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F29453582D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5CEC22 second address: 5CEC27 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5CED46 second address: 5CED4C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5CED4C second address: 5CED69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F2944535545h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5CED69 second address: 5CED8E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29453582E1h 0x00000007 jng 00007F29453582D6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jnc 00007F29453582D6h 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5CED8E second address: 5CED92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5CF075 second address: 5CF079 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5CF079 second address: 5CF0CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F294453553Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F2944535546h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jo 00007F2944535549h 0x00000017 jmp 00007F2944535541h 0x0000001c push esi 0x0000001d pop esi 0x0000001e jmp 00007F294453553Dh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5CF0CA second address: 5CF0D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F29453582D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5CF418 second address: 5CF43B instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F2944535536h 0x00000008 jmp 00007F2944535549h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5CF43B second address: 5CF448 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jbe 00007F29453582D6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5CF59E second address: 5CF5BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b jmp 00007F294453553Ch 0x00000010 ja 00007F2944535536h 0x00000016 push eax 0x00000017 pop eax 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5CF5BE second address: 5CF5CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F29453582D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5CF5CA second address: 5CF5CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5D026C second address: 5D02B9 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F29453582D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007F29453582F4h 0x00000012 jne 00007F29453582D6h 0x00000018 jmp 00007F29453582E8h 0x0000001d jno 00007F29453582EDh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5D3149 second address: 5D314D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5D314D second address: 5D3159 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5D3159 second address: 5D3163 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F2944535536h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5D3163 second address: 5D3179 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007F29453582D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5D3179 second address: 5D3187 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F294453553Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5D489C second address: 5D48D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jmp 00007F29453582E7h 0x00000011 popad 0x00000012 jmp 00007F29453582E2h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5D48D2 second address: 5D48DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5D48DA second address: 5D48E4 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F29453582D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5D8289 second address: 5D828D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5D828D second address: 5D82A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F29453582E1h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5D82A6 second address: 5D82AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5D71E5 second address: 5D71EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5D9D11 second address: 5D9D17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5D9D17 second address: 5D9D1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5D9D1B second address: 5D9D32 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F294453553Ch 0x0000000c pushad 0x0000000d push esi 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5DF6AE second address: 5DF6B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5DF6B4 second address: 5DF6B9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5DF6B9 second address: 5DF6D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F29453582DEh 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5DF6D4 second address: 5DF6E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F2944535536h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jl 00007F2944535536h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5A608B second address: 5A6098 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jnc 00007F29453582D6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5A6098 second address: 5A60A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jo 00007F2944535536h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5A60A4 second address: 5A60C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29453582E9h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5DEAE9 second address: 5DEAEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5DEAEE second address: 5DEB06 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F29453582E1h 0x00000008 pop ebx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5DEB06 second address: 5DEB0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5DEC89 second address: 5DEC8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5DEC8D second address: 5DECA7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007F2944535540h 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5DEE4E second address: 5DEE5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 jno 00007F29453582D6h 0x0000000e push esi 0x0000000f pop esi 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5DEE5F second address: 5DEE65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5DF3ED second address: 5DF3F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5DF3F2 second address: 5DF40F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2944535547h 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5DF40F second address: 5DF41E instructions: 0x00000000 rdtsc 0x00000002 ja 00007F29453582D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push esi 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E1830 second address: 5E183A instructions: 0x00000000 rdtsc 0x00000002 jl 00007F2944535536h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E183A second address: 5E1857 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F29453582DCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push edi 0x0000000f pop edi 0x00000010 jo 00007F29453582D6h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E19C6 second address: 5E19CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E22F0 second address: 5E2356 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], ebx 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007F29453582D8h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 00000016h 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 jl 00007F29453582E3h 0x0000002a pushad 0x0000002b jno 00007F29453582D6h 0x00000031 mov edi, 773FC64Fh 0x00000036 popad 0x00000037 nop 0x00000038 jmp 00007F29453582E2h 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007F29453582E5h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E2356 second address: 5E235B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E280D second address: 5E2811 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E2811 second address: 5E281D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E281D second address: 5E2835 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ecx 0x0000000a popad 0x0000000b nop 0x0000000c and esi, 291A9FCAh 0x00000012 push eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E2835 second address: 5E2839 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E2D71 second address: 5E2D75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E358A second address: 5E358E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E481C second address: 5E4822 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E5203 second address: 5E5209 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E5209 second address: 5E5222 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F29453582E5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E529E second address: 5E52A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E52A2 second address: 5E52B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007F29453582D6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E5B2E second address: 5E5B34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E5B34 second address: 5E5B38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E68AD second address: 5E68B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E6645 second address: 5E6649 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E6649 second address: 5E664F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E7DAC second address: 5E7DE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 nop 0x00000006 jng 00007F29453582DCh 0x0000000c mov dword ptr [ebp+122D17A4h], ecx 0x00000012 push 00000000h 0x00000014 jmp 00007F29453582E6h 0x00000019 push 00000000h 0x0000001b mov dword ptr [ebp+122D1A1Ch], ebx 0x00000021 xchg eax, ebx 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 push ecx 0x00000027 pop ecx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E7DE5 second address: 5E7DEB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E7DEB second address: 5E7E28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29453582E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F29453582E9h 0x00000012 push esi 0x00000013 pop esi 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E9891 second address: 5E9895 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E9895 second address: 5E989F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E989F second address: 5E98A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F2944535536h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E98A9 second address: 5E98AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5EAE92 second address: 5EAE9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5ED0B1 second address: 5ED0B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5EE241 second address: 5EE245 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5EF092 second address: 5EF0A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29453582DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E7B60 second address: 5E7B67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E7B67 second address: 5E7B71 instructions: 0x00000000 rdtsc 0x00000002 je 00007F29453582DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5F01C2 second address: 5F01C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5EB02D second address: 5EB031 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5EB031 second address: 5EB037 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5EC14F second address: 5EC173 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29453582E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F29453582DAh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5EC173 second address: 5EC179 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5F42B6 second address: 5F42BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5F42BA second address: 5F42C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5F42C0 second address: 5F4331 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29453582DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007F29453582D8h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 or bx, CEE5h 0x00000029 push 00000000h 0x0000002b mov di, BF00h 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push ecx 0x00000034 call 00007F29453582D8h 0x00000039 pop ecx 0x0000003a mov dword ptr [esp+04h], ecx 0x0000003e add dword ptr [esp+04h], 0000001Dh 0x00000046 inc ecx 0x00000047 push ecx 0x00000048 ret 0x00000049 pop ecx 0x0000004a ret 0x0000004b mov ebx, dword ptr [ebp+122D377Eh] 0x00000051 push eax 0x00000052 pushad 0x00000053 pushad 0x00000054 pushad 0x00000055 popad 0x00000056 push eax 0x00000057 push edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5EE4A9 second address: 5EE4AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5EE4AD second address: 5EE4B7 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F29453582D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5ED1FF second address: 5ED21B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2944535544h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5ED21B second address: 5ED21F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5F5142 second address: 5F515B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2944535545h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5F12CF second address: 5F12DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F29453582D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5F60F4 second address: 5F60F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5F60F8 second address: 5F6151 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007F29453582D8h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 mov bx, C51Ah 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push eax 0x0000002f call 00007F29453582D8h 0x00000034 pop eax 0x00000035 mov dword ptr [esp+04h], eax 0x00000039 add dword ptr [esp+04h], 00000014h 0x00000041 inc eax 0x00000042 push eax 0x00000043 ret 0x00000044 pop eax 0x00000045 ret 0x00000046 xor dword ptr [ebp+122D31B8h], eax 0x0000004c cld 0x0000004d push eax 0x0000004e pushad 0x0000004f push eax 0x00000050 push edx 0x00000051 push edx 0x00000052 pop edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5F228E second address: 5F2298 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5F2298 second address: 5F22C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a js 00007F29453582EFh 0x00000010 jmp 00007F29453582E9h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5F719E second address: 5F71A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5F71A3 second address: 5F71D6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F29453582E2h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f jmp 00007F29453582E6h 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5F52C4 second address: 5F52F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F294453553Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 jmp 00007F2944535546h 0x00000019 pop edi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5F53A4 second address: 5F53B2 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F29453582D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5F53B2 second address: 5F53B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5F53B6 second address: 5F53D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29453582DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jnp 00007F29453582E4h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5F53D3 second address: 5F53D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5F623A second address: 5F62E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F29453582D6h 0x0000000a popad 0x0000000b jmp 00007F29453582DAh 0x00000010 popad 0x00000011 push eax 0x00000012 jmp 00007F29453582E0h 0x00000017 nop 0x00000018 push dword ptr fs:[00000000h] 0x0000001f mov edi, esi 0x00000021 mov dword ptr fs:[00000000h], esp 0x00000028 push 00000000h 0x0000002a push edx 0x0000002b call 00007F29453582D8h 0x00000030 pop edx 0x00000031 mov dword ptr [esp+04h], edx 0x00000035 add dword ptr [esp+04h], 00000018h 0x0000003d inc edx 0x0000003e push edx 0x0000003f ret 0x00000040 pop edx 0x00000041 ret 0x00000042 mov dword ptr [ebp+122D1A1Ch], edi 0x00000048 mov dword ptr [ebp+122D1E41h], edx 0x0000004e mov eax, dword ptr [ebp+122D15DDh] 0x00000054 mov dword ptr [ebp+122D17B1h], edx 0x0000005a push FFFFFFFFh 0x0000005c push 00000000h 0x0000005e push esi 0x0000005f call 00007F29453582D8h 0x00000064 pop esi 0x00000065 mov dword ptr [esp+04h], esi 0x00000069 add dword ptr [esp+04h], 0000001Ah 0x00000071 inc esi 0x00000072 push esi 0x00000073 ret 0x00000074 pop esi 0x00000075 ret 0x00000076 or dword ptr [ebp+122DB460h], eax 0x0000007c nop 0x0000007d push eax 0x0000007e push edx 0x0000007f push eax 0x00000080 push edx 0x00000081 jmp 00007F29453582DCh 0x00000086 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5F62E5 second address: 5F62EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5F62EB second address: 5F6305 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F29453582DCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007F29453582D6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5F6305 second address: 5F6313 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F2944535536h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5FE7FB second address: 5FE807 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5F359D second address: 5F35A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 604B96 second address: 604BA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F29453582D6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 604BA2 second address: 604BA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 604BA8 second address: 604BC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F29453582DEh 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 604BC3 second address: 604BC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 604BC7 second address: 604C05 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29453582DAh 0x00000007 jmp 00007F29453582E9h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jc 00007F29453582D8h 0x00000014 pushad 0x00000015 popad 0x00000016 jns 00007F29453582DCh 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 604D88 second address: 604D8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 604D8C second address: 604DB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnc 00007F29453582D6h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F29453582E2h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 604DB0 second address: 604DBA instructions: 0x00000000 rdtsc 0x00000002 jng 00007F2944535536h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 604F17 second address: 604F5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 jmp 00007F29453582E3h 0x0000000d push edi 0x0000000e pop edi 0x0000000f push esi 0x00000010 pop esi 0x00000011 popad 0x00000012 push ebx 0x00000013 jmp 00007F29453582E5h 0x00000018 pop ebx 0x00000019 popad 0x0000001a pushad 0x0000001b jmp 00007F29453582DAh 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 607B9B second address: 607B9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 60B001 second address: 60B00B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F29453582D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 60B092 second address: 60B098 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 60B1EB second address: 60B1EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 60B1EF second address: 60B1F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 612412 second address: 612425 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F29453582DEh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 612425 second address: 61244D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F2944535536h 0x00000009 jmp 00007F2944535547h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 61244D second address: 612451 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6111E3 second address: 6111ED instructions: 0x00000000 rdtsc 0x00000002 jc 00007F2944535536h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6111ED second address: 611205 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F29453582DEh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 611205 second address: 611209 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6118AD second address: 6118B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6118B8 second address: 6118BE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6118BE second address: 6118C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6119D4 second address: 6119D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 611C93 second address: 611CA0 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F29453582D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 611F1A second address: 611F37 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2944535549h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 611F37 second address: 611F3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 611F3D second address: 611F60 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F2944535546h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a ja 00007F2944535558h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 611F60 second address: 611F78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F29453582D6h 0x0000000a push esi 0x0000000b pop esi 0x0000000c jnl 00007F29453582D6h 0x00000012 popad 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6120C8 second address: 612105 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2944535543h 0x00000007 push esi 0x00000008 jmp 00007F294453553Ch 0x0000000d pop esi 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push esi 0x00000011 jl 00007F2944535544h 0x00000017 jmp 00007F294453553Eh 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 615A51 second address: 615A5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 61D1FD second address: 61D219 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop esi 0x00000007 jmp 00007F2944535545h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 61D219 second address: 61D21E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 61D21E second address: 61D224 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 61D224 second address: 61D235 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F29453582DBh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 61D235 second address: 61D23D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 61BF57 second address: 61BF5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 61BF5D second address: 61BF63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 61BF63 second address: 61BF69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 61C4B4 second address: 61C4B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 61C4B8 second address: 61C4BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 61C8FA second address: 61C914 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F294453553Fh 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 61CA9A second address: 61CAA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 61CAA0 second address: 61CAA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 61CAA4 second address: 61CAA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5C2E11 second address: 5C2E15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 61D09B second address: 61D09F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 61D09F second address: 61D0AF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007F2944535536h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 622083 second address: 6220A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F29453582E5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007F29453582E2h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6220A6 second address: 6220AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 622418 second address: 62241F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6226DC second address: 6226EC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a jg 00007F2944535536h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6226EC second address: 6226F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 623032 second address: 623038 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 623038 second address: 623041 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5DFFDA second address: 5DFFE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5DFFE0 second address: 5DFFEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E0575 second address: 5E0598 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007F2944535543h 0x0000000c pop ecx 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E0598 second address: 5E059E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E059E second address: 5E05C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2944535549h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E0768 second address: 5E076C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E076C second address: 5E0796 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], esi 0x00000009 or cx, 4F13h 0x0000000e push eax 0x0000000f pushad 0x00000010 jmp 00007F2944535546h 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E0A56 second address: 5E0A95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebp 0x0000000a call 00007F29453582D8h 0x0000000f pop ebp 0x00000010 mov dword ptr [esp+04h], ebp 0x00000014 add dword ptr [esp+04h], 0000001Dh 0x0000001c inc ebp 0x0000001d push ebp 0x0000001e ret 0x0000001f pop ebp 0x00000020 ret 0x00000021 push edx 0x00000022 movzx ecx, bx 0x00000025 pop ecx 0x00000026 push 00000004h 0x00000028 adc edi, 1B2D94B8h 0x0000002e push eax 0x0000002f pushad 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E0FB9 second address: 5E0FBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E0FBF second address: 5E0FC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E0FC3 second address: 5E0FC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E120C second address: 5E125F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 mov dword ptr [esp], eax 0x00000009 adc cl, 0000001Ch 0x0000000c lea eax, dword ptr [ebp+12486CCDh] 0x00000012 push 00000000h 0x00000014 push edi 0x00000015 call 00007F29453582D8h 0x0000001a pop edi 0x0000001b mov dword ptr [esp+04h], edi 0x0000001f add dword ptr [esp+04h], 0000001Bh 0x00000027 inc edi 0x00000028 push edi 0x00000029 ret 0x0000002a pop edi 0x0000002b ret 0x0000002c stc 0x0000002d nop 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 jnc 00007F29453582D6h 0x00000037 jmp 00007F29453582E2h 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E125F second address: 5E1265 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E1265 second address: 5E1276 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F29453582D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push ebx 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E1276 second address: 5C2E11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ebx 0x00000006 nop 0x00000007 sub dword ptr [ebp+122D1A22h], edi 0x0000000d lea eax, dword ptr [ebp+12486C89h] 0x00000013 mov dl, bh 0x00000015 push eax 0x00000016 jno 00007F294453553Ah 0x0000001c mov dword ptr [esp], eax 0x0000001f mov ecx, dword ptr [ebp+122D3696h] 0x00000025 call dword ptr [ebp+122D1AADh] 0x0000002b push edx 0x0000002c jnc 00007F2944535538h 0x00000032 push eax 0x00000033 push edx 0x00000034 jc 00007F2944535536h 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 629F5F second address: 629F64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 62D6DC second address: 62D6E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 62D6E2 second address: 62D70D instructions: 0x00000000 rdtsc 0x00000002 jg 00007F29453582DEh 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F29453582E9h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 62D871 second address: 62D87D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F2944535538h 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 62D87D second address: 62D893 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F29453582E1h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 62DA1D second address: 62DA27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 62DA27 second address: 62DA2D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 62DA2D second address: 62DA36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 62DB4F second address: 62DB65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F29453582E2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 62DB65 second address: 62DB69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 58CA54 second address: 58CA5E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 634871 second address: 63488A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edx 0x00000006 jmp 00007F2944535541h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 639750 second address: 63975A instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F29453582D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 63975A second address: 639785 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F294453553Ch 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007F2944535542h 0x00000015 push edi 0x00000016 pop edi 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 639B54 second address: 639B5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F29453582D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 639B5E second address: 639B67 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 639CDC second address: 639CF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F29453582DAh 0x00000009 jp 00007F29453582D6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 639E33 second address: 639E49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2944535541h 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E0C47 second address: 5E0CAC instructions: 0x00000000 rdtsc 0x00000002 jno 00007F29453582D8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007F29453582D8h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 00000016h 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 mov dword ptr [ebp+122D178Dh], esi 0x0000002b mov ebx, dword ptr [ebp+12486CC8h] 0x00000031 mov ecx, dword ptr [ebp+122D373Ah] 0x00000037 add eax, ebx 0x00000039 sbb dl, FFFFFFE8h 0x0000003c jmp 00007F29453582E7h 0x00000041 nop 0x00000042 jo 00007F29453582E0h 0x00000048 pushad 0x00000049 push esi 0x0000004a pop esi 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 639F7C second address: 639F8C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007F2944535536h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 639F8C second address: 639F90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 639F90 second address: 639F94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 63A0E3 second address: 63A0E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 63C695 second address: 63C699 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 640994 second address: 6409BB instructions: 0x00000000 rdtsc 0x00000002 jne 00007F29453582D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c jne 00007F29453582E8h 0x00000012 push edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6409BB second address: 6409DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F2944535546h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6409DA second address: 6409DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 63FD3E second address: 63FD60 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jp 00007F2944535536h 0x0000000b jmp 00007F294453553Ch 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jnc 00007F2944535536h 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 63FD60 second address: 63FD9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jns 00007F29453582EAh 0x0000000f jmp 00007F29453582E4h 0x00000014 push eax 0x00000015 push edx 0x00000016 jnl 00007F29453582D6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 63FD9F second address: 63FDA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 64007A second address: 64009D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29453582E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jp 00007F29453582F0h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 640564 second address: 640582 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F294453553Ch 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jg 00007F2944535536h 0x00000013 popad 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 64886F second address: 648875 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 648875 second address: 648879 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 648879 second address: 64887F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 64887F second address: 64888B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 64888B second address: 648893 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 646C2A second address: 646C3E instructions: 0x00000000 rdtsc 0x00000002 je 00007F2944535536h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 646C3E second address: 646C48 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F29453582E2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 646F5C second address: 646F60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 646F60 second address: 646F64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 646F64 second address: 646F6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 646F6A second address: 646F8D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29453582E8h 0x00000007 pushad 0x00000008 je 00007F29453582D6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 646F8D second address: 646F93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 64720C second address: 647212 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 647212 second address: 647221 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push edi 0x00000007 jnp 00007F2944535553h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 64828A second address: 648290 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 648290 second address: 64829B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F2944535536h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 64829B second address: 6482A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6482A8 second address: 6482AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6482AC second address: 6482BF instructions: 0x00000000 rdtsc 0x00000002 jc 00007F29453582D6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6482BF second address: 6482C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6482C7 second address: 6482CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6482CC second address: 6482D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 ja 00007F2944535536h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6482D9 second address: 6482E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007F29453582D6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6485A4 second address: 6485A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6485A8 second address: 6485AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 64D720 second address: 64D728 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 64D728 second address: 64D742 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F29453582DFh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 64D742 second address: 64D756 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2944535540h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 64D756 second address: 64D79A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29453582E8h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b js 00007F29453582D8h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 jl 00007F29453582FBh 0x0000001a jmp 00007F29453582E3h 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 64D79A second address: 64D79E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 64CC1C second address: 64CC21 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 64CFF9 second address: 64D016 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2944535546h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 64D172 second address: 64D189 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F29453582E3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 64D464 second address: 64D468 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 59D9A3 second address: 59D9AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 65A656 second address: 65A66F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jl 00007F294453553Ch 0x0000000b jbe 00007F294453553Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 65AA01 second address: 65AA14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 js 00007F29453582D6h 0x0000000c jg 00007F29453582D6h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 65AA14 second address: 65AA62 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F2944535536h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c ja 00007F294453553Eh 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push ecx 0x00000017 jmp 00007F294453553Eh 0x0000001c jmp 00007F294453553Eh 0x00000021 pop ecx 0x00000022 jns 00007F2944535542h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 65AA62 second address: 65AA68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 65AEC2 second address: 65AEC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 65AEC8 second address: 65AECE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 65AFF2 second address: 65AFF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 65B1A5 second address: 65B1A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 65C1F2 second address: 65C1F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 65A079 second address: 65A07F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 65A07F second address: 65A083 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 65A083 second address: 65A0AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F29453582DBh 0x0000000e jmp 00007F29453582E1h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 65E880 second address: 65E886 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 65E886 second address: 65E894 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F29453582DCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 65E894 second address: 65E898 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6613D0 second address: 6613E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F29453582DFh 0x00000009 jc 00007F29453582D6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6613E9 second address: 661409 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2944535548h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 661409 second address: 661417 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F29453582DAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 666368 second address: 666395 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F294453553Ah 0x00000009 pop esi 0x0000000a jmp 00007F2944535549h 0x0000000f popad 0x00000010 push edi 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 666395 second address: 6663B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F29453582E4h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 670320 second address: 670324 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 674939 second address: 674948 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007F29453582D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 674698 second address: 6746B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2944535546h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 677654 second address: 67765A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 677014 second address: 67702F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2944535547h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 67702F second address: 677039 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 677039 second address: 67703D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 67703D second address: 677043 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 68503B second address: 685052 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2944535543h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 68668B second address: 68668F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 68668F second address: 686695 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 686695 second address: 68669F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F29453582D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 68669F second address: 6866A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 68939A second address: 6893A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6893A0 second address: 6893A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 689242 second address: 689249 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 690470 second address: 69047A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6905DD second address: 6905E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6905E3 second address: 6905F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F294453553Dh 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6905F6 second address: 6905FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6905FC second address: 690619 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F2944535543h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 690619 second address: 69061F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 690765 second address: 69076F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F2944535536h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 69076F second address: 690790 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29453582E3h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007F29453582DCh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 697F29 second address: 697F2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 697F2D second address: 697F31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 69ABAF second address: 69ABB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 69A8BD second address: 69A8C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 69A8C8 second address: 69A8D7 instructions: 0x00000000 rdtsc 0x00000002 je 00007F2944535536h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6A695C second address: 6A697A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F29453582E9h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 596DCD second address: 596DD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 596DD3 second address: 596DFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jne 00007F29453582D6h 0x0000000d jnl 00007F29453582D6h 0x00000013 jmp 00007F29453582E6h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 596DFD second address: 596E0D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F294453553Bh 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6A67FE second address: 6A6818 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jc 00007F29453582D6h 0x0000000e jl 00007F29453582D6h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6A6818 second address: 6A681E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6A681E second address: 6A683B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F29453582D6h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F29453582DDh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6A683B second address: 6A6841 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 591C4C second address: 591C53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 591C53 second address: 591C59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6B980B second address: 6B9814 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6C485F second address: 6C487E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F2944535536h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F2944535545h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6C36E1 second address: 6C36E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6C3B23 second address: 6C3B27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6C3B27 second address: 6C3B2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6C3B2B second address: 6C3B35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6C3B35 second address: 6C3B41 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jns 00007F29453582D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6C3F9C second address: 6C3FA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6C3FA0 second address: 6C3FB5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29453582DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6C40EF second address: 6C4113 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push ecx 0x00000008 pushad 0x00000009 jmp 00007F2944535549h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6C4113 second address: 6C4119 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6C4240 second address: 6C4245 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6C4245 second address: 6C4251 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F29453582DEh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6C4504 second address: 6C4508 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6C4508 second address: 6C4538 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29453582E5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F29453582DCh 0x0000000f pushad 0x00000010 popad 0x00000011 push edi 0x00000012 pop edi 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 push ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6C4538 second address: 6C4552 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F2944535536h 0x0000000a pop ebx 0x0000000b push ebx 0x0000000c jl 00007F2944535536h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 pop ebx 0x00000015 popad 0x00000016 push esi 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6C4552 second address: 6C4563 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F29453582D6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6C4563 second address: 6C4567 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6C8B93 second address: 6C8BA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F29453582E1h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6C8EEE second address: 6C8EF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6CA8D5 second address: 6CA8F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29453582E6h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jo 00007F29453582E2h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6CA8F9 second address: 6CA8FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 6CA8FF second address: 6CA92A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F29453582E4h 0x0000000a push eax 0x0000000b pop eax 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e popad 0x0000000f pushad 0x00000010 jnc 00007F29453582D6h 0x00000016 pushad 0x00000017 popad 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F099A second address: 49F09B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2944535549h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 499078A second address: 4990790 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4990790 second address: 49907F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F294453553Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F2944535544h 0x00000014 sub si, B9E8h 0x00000019 jmp 00007F294453553Bh 0x0000001e popfd 0x0000001f jmp 00007F2944535548h 0x00000024 popad 0x00000025 and esp, FFFFFFF8h 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F294453553Ah 0x00000031 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49907F4 second address: 49907F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49907F8 second address: 49907FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49907FE second address: 4990804 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4990804 second address: 499083B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 sub esp, 34h 0x0000000b pushad 0x0000000c mov edx, esi 0x0000000e jmp 00007F294453553Eh 0x00000013 popad 0x00000014 xchg eax, ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F2944535547h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 499083B second address: 4990893 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29453582E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c mov edx, 1875F780h 0x00000011 pushfd 0x00000012 jmp 00007F29453582E9h 0x00000017 jmp 00007F29453582DBh 0x0000001c popfd 0x0000001d popad 0x0000001e mov ax, BF3Fh 0x00000022 popad 0x00000023 xchg eax, ebx 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 mov bx, cx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4990893 second address: 49908E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F294453553Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007F2944535542h 0x0000000f sub eax, 03053B58h 0x00000015 jmp 00007F294453553Bh 0x0000001a popfd 0x0000001b popad 0x0000001c mov ebx, dword ptr [ebp+08h] 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F2944535545h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49908E1 second address: 4990912 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, 74h 0x00000005 call 00007F29453582E8h 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F29453582DDh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4990912 second address: 4990960 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F2944535547h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], esi 0x00000010 jmp 00007F2944535544h 0x00000015 xchg eax, edi 0x00000016 jmp 00007F2944535540h 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4990960 second address: 4990964 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4990964 second address: 499096A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 499096A second address: 4990970 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4990970 second address: 4990974 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4990974 second address: 4990978 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4990978 second address: 4990997 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, edi 0x00000009 pushad 0x0000000a mov cl, dl 0x0000000c movzx esi, dx 0x0000000f popad 0x00000010 mov edi, dword ptr [ebp+0Ch] 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F294453553Ah 0x0000001a rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4990997 second address: 4990A0E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 0EB7E744h 0x00000008 pushfd 0x00000009 jmp 00007F29453582DDh 0x0000000e and ecx, 358EC086h 0x00000014 jmp 00007F29453582E1h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d sub esi, esi 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007F29453582E8h 0x00000026 adc ax, CE58h 0x0000002b jmp 00007F29453582DBh 0x00000030 popfd 0x00000031 popad 0x00000032 mov dword ptr [esp+10h], esi 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007F29453582E0h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4990A0E second address: 4990A14 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4990A14 second address: 4990A2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, esi 0x00000005 movzx esi, bx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+14h], esi 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 mov edx, eax 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4990A2B second address: 4990A6B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F294453553Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [edi] 0x0000000b jmp 00007F2944535546h 0x00000010 xchg eax, ebx 0x00000011 pushad 0x00000012 mov cx, 3C8Dh 0x00000016 mov ax, 1489h 0x0000001a popad 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f mov di, si 0x00000022 mov ebx, ecx 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4990A6B second address: 4990B11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F29453582DFh 0x00000009 or si, 89EEh 0x0000000e jmp 00007F29453582E9h 0x00000013 popfd 0x00000014 movzx eax, dx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebx 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007F29453582E9h 0x00000022 xor esi, 2AED80D6h 0x00000028 jmp 00007F29453582E1h 0x0000002d popfd 0x0000002e mov bx, si 0x00000031 popad 0x00000032 push FC53D4BFh 0x00000037 jmp 00007F29453582E3h 0x0000003c add dword ptr [esp], 79C1759Dh 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007F29453582E5h 0x0000004a rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4990B11 second address: 4990B1A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, B322h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4990B8C second address: 4990B92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4990B92 second address: 4990B96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4A00269 second address: 4A0026D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4A0026D second address: 4A00271 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4A00271 second address: 4A00277 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4A00277 second address: 4A0027D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4A0027D second address: 4A00281 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4A00281 second address: 4A00292 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c mov edi, 66EB41B2h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4A00292 second address: 4A002BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 mov eax, edi 0x00000009 jmp 00007F29453582E1h 0x0000000e popad 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F29453582DDh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4A002BD second address: 4A002FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2944535541h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F294453553Eh 0x00000010 push dword ptr [ebp+0Ch] 0x00000013 jmp 00007F2944535540h 0x00000018 push dword ptr [ebp+08h] 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4A002FE second address: 4A00302 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4A00302 second address: 4A00306 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4A00306 second address: 4A0030C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4A0030C second address: 4A00369 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 357C5091h 0x00000008 pushfd 0x00000009 jmp 00007F294453553Eh 0x0000000e or esi, 5C8911E8h 0x00000014 jmp 00007F294453553Bh 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d call 00007F2944535539h 0x00000022 jmp 00007F2944535546h 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F294453553Dh 0x00000031 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4A00369 second address: 4A0037E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29453582E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4A0037E second address: 4A003D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2944535541h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007F2944535541h 0x00000012 mov eax, dword ptr [eax] 0x00000014 jmp 00007F2944535541h 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 call 00007F294453553Ah 0x00000025 pop eax 0x00000026 mov dx, 4426h 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4A003D2 second address: 4A003E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F29453582E3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4A003E9 second address: 4A003FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a mov ecx, edx 0x0000000c push eax 0x0000000d push edx 0x0000000e mov ebx, 1CC58DE0h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4A00434 second address: 4A00438 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49A0CA0 second address: 49A0CA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49A0CA4 second address: 49A0CAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49A0CAA second address: 49A0CD7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F294453553Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F2944535543h 0x00000012 mov si, FBCFh 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49A0008 second address: 49A000E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49A000E second address: 49A0048 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2944535544h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F2944535540h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F294453553Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49A0048 second address: 49A005A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F29453582DEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49A005A second address: 49A0072 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F294453553Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49A0072 second address: 49A008D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29453582E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49A008D second address: 49A0093 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49A0093 second address: 49A0097 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49A0097 second address: 49A00C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b push edi 0x0000000c jmp 00007F2944535548h 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49A00C0 second address: 49A00C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F080A second address: 49F0810 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F0810 second address: 49F0838 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 jmp 00007F29453582E6h 0x0000000e mov dword ptr [esp], ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F0838 second address: 49F0855 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2944535549h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F0855 second address: 49F087B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29453582E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F29453582DDh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F087B second address: 49F08D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, ebx 0x00000005 pushfd 0x00000006 jmp 00007F2944535543h 0x0000000b jmp 00007F2944535543h 0x00000010 popfd 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pop ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 call 00007F294453553Bh 0x0000001d pop ecx 0x0000001e jmp 00007F2944535549h 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F08D5 second address: 49F08E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F29453582DCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F05A3 second address: 49F0635 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2944535549h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebp+08h] 0x0000000c jmp 00007F294453553Eh 0x00000011 mov esi, eax 0x00000013 pushad 0x00000014 jmp 00007F294453553Eh 0x00000019 pushad 0x0000001a mov cx, CBD7h 0x0000001e pushfd 0x0000001f jmp 00007F294453553Ch 0x00000024 and esi, 72026648h 0x0000002a jmp 00007F294453553Bh 0x0000002f popfd 0x00000030 popad 0x00000031 popad 0x00000032 sub esi, edx 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 pushfd 0x00000038 jmp 00007F2944535540h 0x0000003d jmp 00007F2944535545h 0x00000042 popfd 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F0635 second address: 49F0684 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29453582DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov cl, byte ptr [edx] 0x0000000b jmp 00007F29453582E0h 0x00000010 mov byte ptr [esi+edx], cl 0x00000013 jmp 00007F29453582E0h 0x00000018 inc edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F29453582E7h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F0684 second address: 49F069C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2944535544h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F069C second address: 49F0700 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29453582DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test cl, cl 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F29453582E4h 0x00000014 xor si, D558h 0x00000019 jmp 00007F29453582DBh 0x0000001e popfd 0x0000001f mov bx, si 0x00000022 popad 0x00000023 jne 00007F294535823Bh 0x00000029 pushad 0x0000002a push ebx 0x0000002b mov dx, cx 0x0000002e pop ecx 0x0000002f popad 0x00000030 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007F29453582E0h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F0700 second address: 49F0775 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F294453553Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, dword ptr [ebp-10h] 0x0000000c pushad 0x0000000d mov cl, 79h 0x0000000f call 00007F2944535541h 0x00000014 mov ch, 07h 0x00000016 pop edi 0x00000017 popad 0x00000018 mov dword ptr fs:[00000000h], ecx 0x0000001f jmp 00007F2944535548h 0x00000024 pop ecx 0x00000025 jmp 00007F2944535540h 0x0000002a pop edi 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e pushad 0x0000002f popad 0x00000030 call 00007F2944535543h 0x00000035 pop esi 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F0775 second address: 49F07D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F29453582E4h 0x00000009 adc si, 1068h 0x0000000e jmp 00007F29453582DBh 0x00000013 popfd 0x00000014 mov ax, D65Fh 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b pop esi 0x0000001c jmp 00007F29453582E2h 0x00000021 pop ebx 0x00000022 jmp 00007F29453582E0h 0x00000027 leave 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b movsx ebx, si 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F07D2 second address: 49F07D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F07D7 second address: 49F07DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F07DD second address: 49F07E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F07E1 second address: 49F07E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F07E5 second address: 49F080A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 retn 0008h 0x0000000b nop 0x0000000c mov eax, esi 0x0000000e pop esi 0x0000000f pop edi 0x00000010 pop ebx 0x00000011 pop ebp 0x00000012 retn 0004h 0x00000015 lea ecx, dword ptr [ebp-50h] 0x00000018 push 0041FD48h 0x0000001d call 00007F294452E842h 0x00000022 push ebp 0x00000023 push ebx 0x00000024 push edi 0x00000025 push esi 0x00000026 mov esi, ecx 0x00000028 mov ebx, dword ptr [esp+14h] 0x0000002c push ebx 0x0000002d call 00007F2948B168A5h 0x00000032 mov edi, edi 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F2944535546h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F00E0 second address: 49F0148 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 movsx edx, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov al, byte ptr [edx] 0x0000000d jmp 00007F29453582DCh 0x00000012 inc edx 0x00000013 pushad 0x00000014 mov ecx, 57B7393Dh 0x00000019 pushfd 0x0000001a jmp 00007F29453582DAh 0x0000001f jmp 00007F29453582E5h 0x00000024 popfd 0x00000025 popad 0x00000026 test al, al 0x00000028 pushad 0x00000029 pushfd 0x0000002a jmp 00007F29453582DCh 0x0000002f sub esi, 1837A578h 0x00000035 jmp 00007F29453582DBh 0x0000003a popfd 0x0000003b push eax 0x0000003c push edx 0x0000003d mov al, F8h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F0148 second address: 49F0148 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F294453553Bh 0x00000008 and ah, 0000003Eh 0x0000000b jmp 00007F2944535549h 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 jne 00007F29445354A5h 0x0000001a mov al, byte ptr [edx] 0x0000001c jmp 00007F294453553Ch 0x00000021 inc edx 0x00000022 pushad 0x00000023 mov ecx, 57B7393Dh 0x00000028 pushfd 0x00000029 jmp 00007F294453553Ah 0x0000002e jmp 00007F2944535545h 0x00000033 popfd 0x00000034 popad 0x00000035 test al, al 0x00000037 pushad 0x00000038 pushfd 0x00000039 jmp 00007F294453553Ch 0x0000003e sub esi, 1837A578h 0x00000044 jmp 00007F294453553Bh 0x00000049 popfd 0x0000004a push eax 0x0000004b push edx 0x0000004c mov al, F8h 0x0000004e rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F01F7 second address: 49F01FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F01FD second address: 49F0297 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2944535542h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov al, byte ptr [edi+01h] 0x0000000e jmp 00007F2944535540h 0x00000013 inc edi 0x00000014 jmp 00007F2944535540h 0x00000019 test al, al 0x0000001b jmp 00007F2944535540h 0x00000020 jne 00007F29B5C2DD6Ah 0x00000026 jmp 00007F2944535540h 0x0000002b mov ecx, edx 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 jmp 00007F294453553Dh 0x00000035 pushfd 0x00000036 jmp 00007F2944535540h 0x0000003b xor ecx, 4878D2D8h 0x00000041 jmp 00007F294453553Bh 0x00000046 popfd 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F0297 second address: 49F029D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F029D second address: 49F02A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F02A1 second address: 49F030C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 shr ecx, 02h 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F29453582DDh 0x00000012 xor ax, 4276h 0x00000017 jmp 00007F29453582E1h 0x0000001c popfd 0x0000001d mov di, cx 0x00000020 popad 0x00000021 rep movsd 0x00000023 rep movsd 0x00000025 rep movsd 0x00000027 rep movsd 0x00000029 pushad 0x0000002a mov cx, 9A5Fh 0x0000002e pushfd 0x0000002f jmp 00007F29453582E4h 0x00000034 add cx, 96C8h 0x00000039 jmp 00007F29453582DBh 0x0000003e popfd 0x0000003f popad 0x00000040 mov ecx, edx 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F030C second address: 49F0327 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2944535547h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F041E second address: 49F048C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ebx 0x00000006 jmp 00007F29453582DCh 0x0000000b pop esi 0x0000000c popad 0x0000000d pop edi 0x0000000e jmp 00007F29453582E1h 0x00000013 pop esi 0x00000014 pushad 0x00000015 mov edx, eax 0x00000017 jmp 00007F29453582E8h 0x0000001c popad 0x0000001d pop ebx 0x0000001e jmp 00007F29453582E0h 0x00000023 leave 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 pushad 0x00000028 popad 0x00000029 jmp 00007F29453582E3h 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F048C second address: 49F0491 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E4155 second address: 5E4175 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29453582E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jl 00007F29453582D6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E43BA second address: 5E43E5 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F2944535536h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jne 00007F294453554Eh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E43E5 second address: 5E43EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 5E43EB second address: 5E43EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49C084F second address: 49C0856 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49C0856 second address: 49C088E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push esi 0x0000000a pop ecx 0x0000000b push edi 0x0000000c mov al, 36h 0x0000000e pop edx 0x0000000f popad 0x00000010 xchg eax, ebp 0x00000011 jmp 00007F294453553Ch 0x00000016 mov ebp, esp 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F2944535547h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49C088E second address: 49C08BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29453582E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F29453582DDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49B00EC second address: 49B00F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F0A63 second address: 49F0A67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F0A67 second address: 49F0A83 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2944535548h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F0A83 second address: 49F0A89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F0A89 second address: 49F0A8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F0A8D second address: 49F0AC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 jmp 00007F29453582E9h 0x0000000e push 18F2E141h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F29453582DAh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F0AC0 second address: 49F0B01 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F294453553Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 6E05E171h 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F2944535544h 0x00000017 adc ax, F4A8h 0x0000001c jmp 00007F294453553Bh 0x00000021 popfd 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 pop ebx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F0BE4 second address: 49F0C13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ah, 78h 0x00000005 mov edi, 761811E2h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ebx 0x0000000e pushad 0x0000000f pushad 0x00000010 mov ah, 5Fh 0x00000012 mov di, B792h 0x00000016 popad 0x00000017 pushad 0x00000018 mov bx, 478Ch 0x0000001c mov ecx, ebx 0x0000001e popad 0x0000001f popad 0x00000020 mov dword ptr [esp], eax 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F29453582DAh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F0C13 second address: 49F0C25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F294453553Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F0C52 second address: 49F0C58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F0C58 second address: 49F0C76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test eax, eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F2944535542h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F0D1F second address: 49F0D23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F0D23 second address: 49F0D6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [ebp-00000118h], eax 0x0000000d jmp 00007F294453553Eh 0x00000012 test eax, eax 0x00000014 jmp 00007F2944535540h 0x00000019 je 00007F29B6A878A9h 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F2944535547h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F0D6F second address: 49F0D87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F29453582E4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F0D87 second address: 49F0DC0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F294453553Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c jmp 00007F2944535546h 0x00000011 push eax 0x00000012 pushad 0x00000013 mov ax, dx 0x00000016 mov dx, 8380h 0x0000001a popad 0x0000001b nop 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F0DC0 second address: 49F0DC6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F0DC6 second address: 49F0DCC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F0DCC second address: 49F0DD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F0DD0 second address: 49F0DD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F0DD4 second address: 49F0DFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea ecx, dword ptr [ebx+04h] 0x0000000b pushad 0x0000000c mov si, bx 0x0000000f mov eax, edi 0x00000011 popad 0x00000012 push 00000027h 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F29453582E0h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49F0DFA second address: 49F0E47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F2944535541h 0x00000008 mov ebx, ecx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F294453553Fh 0x00000017 sub ah, 0000001Eh 0x0000001a jmp 00007F2944535549h 0x0000001f popfd 0x00000020 mov ah, A3h 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4A00735 second address: 4A0076B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 49FAh 0x00000007 jmp 00007F29453582DBh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 pushad 0x00000012 movzx ecx, bx 0x00000015 mov eax, ebx 0x00000017 popad 0x00000018 popad 0x00000019 push eax 0x0000001a jmp 00007F29453582DFh 0x0000001f xchg eax, ebp 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4A0076B second address: 4A0076F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4A0076F second address: 4A00773 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4A00773 second address: 4A00779 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4A00779 second address: 4A00796 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F29453582E9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4A004A3 second address: 4A004A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4A004A8 second address: 4A004F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov di, B9A8h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d mov bx, si 0x00000010 pushfd 0x00000011 jmp 00007F29453582E8h 0x00000016 adc si, 2C08h 0x0000001b jmp 00007F29453582DBh 0x00000020 popfd 0x00000021 popad 0x00000022 xchg eax, ebp 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F29453582E0h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4A004F8 second address: 4A004FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4A004FC second address: 4A00502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4A00502 second address: 4A00508 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4A00508 second address: 4A0050C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4A0050C second address: 4A00510 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4A00510 second address: 4A00535 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F29453582E4h 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4A00535 second address: 4A00539 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4A00539 second address: 4A00556 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F29453582E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4A00909 second address: 4A009DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F2944535547h 0x00000009 or cx, D37Eh 0x0000000e jmp 00007F2944535549h 0x00000013 popfd 0x00000014 push ecx 0x00000015 pop edx 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a jmp 00007F294453553Dh 0x0000001f xchg eax, ebp 0x00000020 pushad 0x00000021 pushad 0x00000022 mov bx, si 0x00000025 call 00007F2944535546h 0x0000002a pop esi 0x0000002b popad 0x0000002c pushfd 0x0000002d jmp 00007F294453553Bh 0x00000032 add eax, 3AD8A2EEh 0x00000038 jmp 00007F2944535549h 0x0000003d popfd 0x0000003e popad 0x0000003f mov ebp, esp 0x00000041 jmp 00007F294453553Eh 0x00000046 mov ecx, dword ptr [ebp+08h] 0x00000049 jmp 00007F2944535540h 0x0000004e test ecx, ecx 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007F2944535547h 0x00000057 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4A009DF second address: 4A00A0B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edi 0x00000005 mov di, 9B36h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c je 00007F29B68DA52Bh 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F29453582E8h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4A00A0B second address: 4A00A11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4A00A11 second address: 4A00A15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 4A00A15 second address: 4A00A19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49C09C4 second address: 49C09C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random(2).exe	RDTSC instruction interceptor: First address: 49C09C8 second address: 49C09CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\random(2).exe	Special instruction interceptor: First address: 42C955 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\random(2).exe	Special instruction interceptor: First address: 42C9F6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\random(2).exe	Special instruction interceptor: First address: 5D83D8 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\random(2).exe	Special instruction interceptor: First address: 5D86FA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\random(2).exe	Special instruction interceptor: First address: 42A2F6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\random(2).exe	Special instruction interceptor: First address: 66B584 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\random(2).exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\random(2).exe TID: 6216	Thread sleep count: 39 > 30	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe TID: 6216	Thread sleep time: -78039s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe TID: 6188	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe TID: 6188	Thread sleep time: -76038s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe TID: 6264	Thread sleep count: 46 > 30	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe TID: 6264	Thread sleep time: -92046s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\random(2).exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior

Source: chrome.exe, 0000000C.00000002.2646823383.00000249D66DA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V VM Vid Partitionll]
Source: chrome.exe, 0000000C.00000002.2646823383.00000249D66F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Dynamic Memory Integration Service
Source: chrome.exe, 0000000C.00000003.2431385780.00000249D9B7E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2649650384.00000249D9B7E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2434796883.00000249D9B7E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2433036035.00000249D9B7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Dynamic Memory Integration ServiceY
Source: chrome.exe, 0000000C.00000003.2432227323.00000249D6721000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2434425374.00000249D6721000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2646823383.00000249D66F1000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2430756068.00000249D6721000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Root PartitionRH
Source: chrome.exe, 0000000C.00000003.2431385780.00000249D9B7E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2649650384.00000249D9B7E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2434796883.00000249D9B7E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2433036035.00000249D9B7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: X2Hyper-V VM Vid Partition
Source: chrome.exe, 0000000C.00000003.2431385780.00000249D9B7E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2649650384.00000249D9B7E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2434796883.00000249D9B7E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2433036035.00000249D9B7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: THyper-V Hypervisor Root Virtual Processor
Source: chrome.exe, 0000000C.00000003.2433036035.00000249D9BB9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flus
Source: chrome.exe, 0000000C.00000002.2646823383.00000249D66F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: JHyper-V Hypervisor Logical Processor9
Source: chrome.exe, 0000000C.00000002.2646823383.00000249D66F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: JHyper-V Hypervisor Logical Processor
Source: chrome.exe, 0000000C.00000003.2430674176.00000249D9C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Sched
Source: chrome.exe, 0000000C.00000002.2646823383.00000249D66F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DHyper-V Hypervisor Root Partition
Source: chrome.exe, 0000000C.00000003.2431385780.00000249D9B7E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2649650384.00000249D9B7E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2434796883.00000249D9B7E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2433036035.00000249D9B7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Hypervisor
Source: chrome.exe, 0000000C.00000003.2432227323.00000249D6769000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2646823383.00000249D6769000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V hjyxccxlsbpgevf Bus
Source: chrome.exe, 0000000C.00000003.2431385780.00000249D9B7E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2649650384.00000249D9B7E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2434796883.00000249D9B7E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2433036035.00000249D9B7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V hjyxccxlsbpgevf Bus Pipes
Source: chrome.exe, 0000000C.00000003.2389764630.00003CCC00314000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware20,1(
Source: chrome.exe, 0000000C.00000003.2431385780.00000249D9B7E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2649650384.00000249D9B7E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2434796883.00000249D9B7E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2433036035.00000249D9B7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: THyper-V Hypervisor Root Virtual Processor]
Source: chrome.exe, 0000000C.00000002.2646823383.00000249D669B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Hypervisor
Source: chrome.exe, 0000000C.00000003.2431385780.00000249D9B7E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2649650384.00000249D9B7E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2434796883.00000249D9B7E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2433036035.00000249D9B7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V VM Vid Partition
Source: chrome.exe, 0000000C.00000002.2646823383.00000249D66F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Root Partition\|xG.
Source: chrome.exe, 0000000C.00000002.2646823383.00000249D66F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DHyper-V Virtual Machine Bus PipesJ
Source: chrome.exe, 0000000C.00000003.2430624506.00000249D9C13000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2434128229.00000249D9C13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840
Source: chrome.exe, 0000000C.00000003.2431385780.00000249D9B7E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2649650384.00000249D9B7E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2434796883.00000249D9B7E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2433036035.00000249D9B7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VHyper-V Dynamic Memory Integration Service
Source: chrome.exe, 0000000C.00000002.2646823383.00000249D66F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: sWDHyper-V Hypervisor Root Partitions
Source: chrome.exe, 0000000C.00000002.2540680415.00000249D29DD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: chrome.exe, 0000000C.00000002.2646823383.00000249D66F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Logical Processor.sys
Source: chrome.exe, 0000000C.00000003.2431385780.00000249D9B7E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2649650384.00000249D9B7E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2434796883.00000249D9B7E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2433036035.00000249D9B7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VHyper-V Dynamic Memory Integration Service
Source: chrome.exe, 0000000C.00000003.2433658544.00000249D9C10000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2434128229.00000249D9C13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Teredo Router Solicitation3218Out - Teredo Bubble3220Out - Teredo Data3222In - Teredo Data User Mode3224In - Teredo Data Kernel Mode3226Out - Teredo Data User Mode3228Out - Teredo Data Kernel Mode6468Hyper-V Dynamic Memory Integration Service6470Maximum Memory, Mbytes1848Bluetooth Radio1850Classic ACL bytes written/sec1852LE ACL bytes written/sec1854SCO bytes written/sec1856Classic ACL bytes read/sec1858LE ACL bytes read/sec1860SCO bytes read/sec1862Classic ACL Connections1864LE ACL Connections1866SCO Connections1868Sideband SCO Connections1870ACL flush events/sec1872LE ACL write credits1874Classic ACL write credits1876LE Scan Duty Cycle (%) - Uncoded 1M Phy1878LE Scan Window - Uncoded 1M Phy1880LE Scan Interval - Uncoded 1M Phy1882Page Scan Duty Cycle (%)1884Page Scan Window1886Page Scan Interval1888Inquiry Scan Duty Cycle (%)1890Inquiry Scan Window1892Inquiry Scan Interval1894LE Scan Duty Cycle (%) - Coded Phy1896LE Scan Window - Coded Phy1898LE Scan Interval - Coded Phy1900Bluetooth Device1902Classic ACL bytes written/sec1904LE ACL bytes written/sec1906SCO bytes written/sec1908Classic ACL bytes read/sec1910LE ACL bytes read/sec1912SCO bytes read/sec3814ServiceModelService 4.0.0.03816Calls
Source: chrome.exe, 0000000C.00000002.2646823383.00000249D66F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Logical Processormui
Source: chrome.exe, 0000000C.00000002.2646823383.00000249D66F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Virtual Machine Bus Pipes
Source: chrome.exe, 0000000C.00000002.2646823383.00000249D66F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AlDHyper-V Virtual Machine Bus Pipes
Source: chrome.exe, 0000000C.00000002.2646823383.00000249D66F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Root Virtual Processor[\|f.
Source: chrome.exe, 0000000C.00000003.2433036035.00000249D9BC0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Inte
Source: chrome.exe, 0000000C.00000003.2433658544.00000249D9BE2000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2436019975.00000249D9C03000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2433658544.00000249D9C05000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2436263825.00000249D9BF2000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2435809667.00000249D9BE9000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2436019975.00000249D9BF9000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2649650384.00000249D9BB9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6242WorkflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot
Source: chrome.exe, 0000000C.00000003.2432227323.00000249D6721000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2434425374.00000249D6721000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2646823383.00000249D66F1000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2430756068.00000249D6721000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Dynamic Memory Integration ServiceI
Source: chrome.exe, 0000000C.00000002.2646823383.00000249D66F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Root Virtual Processor?}
Source: chrome.exe, 0000000C.00000003.2434955646.00000249D9BBD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976Hypervisor Run Time4978Remote Node Run Time4980Normalized Run Time4982Ideal Cpu4984Hypercalls/sec4986Hypercalls Cost4988Page Invalidations/sec4990Page Invalidations Cost4992Control Register Accesses/sec4994Con
Source: chrome.exe, 0000000C.00000002.2649650384.00000249D9B38000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2434796883.00000249D9B4E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2433036035.00000249D9B4E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2431385780.00000249D9B4A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor
Source: chrome.exe, 0000000C.00000003.2431385780.00000249D9B7E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2649650384.00000249D9B7E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2434796883.00000249D9B7E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2433036035.00000249D9B7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2Hyper-V VM Vid Partition

Source: C:\Users\user\Desktop\random(2).exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\random(2).exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\random(2).exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\random(2).exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\random(2).exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\random(2).exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\random(2).exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\random(2).exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\random(2).exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\random(2).exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\random(2).exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\random(2).exe	File opened: NTICE
Source: C:\Users\user\Desktop\random(2).exe	File opened: SICE
Source: C:\Users\user\Desktop\random(2).exe	File opened: SIWVID

Source: C:\Users\user\Desktop\random(2).exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\random(2).exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\random(2).exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\random(2).exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 00000000.00000003.1130116827.0000000000B79000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1152734556.0000000000B76000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1171301147.0000000000B77000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: random(2).exe PID: 6980, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\random(2).exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\random(2).exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Source: Yara match

File source: Process Memory Space: random(2).exe PID: 6980, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\random(2).exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 00000000.00000003.1130116827.0000000000B79000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1152734556.0000000000B76000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1171301147.0000000000B77000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: random(2).exe PID: 6980, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	1 OS Credential Dumping	631 Security Software Discovery	Remote Services	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	24 Virtualization/Sandbox Evasion	LSASS Memory	24 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Remote Access Software	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	1 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Software Packing	LSA Secrets	223 System Information Discovery	SSH	Keylogging	4 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
random(2).exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report random(2).exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
random(2).exe