Windows Analysis Report
nrKr2roAsG.exe

Overview

General Information

Sample name: nrKr2roAsG.exe
renamed because original name is a hash value
Original sample name: a910f73ee1f155ed585016e76cf5532c.exe
Analysis ID: 1647696
MD5: a910f73ee1f155ed585016e76cf5532c
SHA1: 6da4a841d64bf75c15e0c2dd0a34fd6b1d2b6411
SHA256: fedcaf57f0459c113cf0b609ec2713b111e50d25d15e321ccaa5dc89d72528e8
Tags: exeuser-abuse_ch
Infos:

Detection

Amadey
Score: 100
Range: 0 - 100
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected Amadey
Yara detected Amadeys Clipper DLL
C2 URLs / IPs found in malware configuration
Contains functionality to start a terminal service
Hides threads from debuggers
Joe Sandbox ML detected suspicious sample
PE file contains section with special chars
Sample uses string decryption to hide its real strings
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Abnormal high CPU Usage
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates job files (autostart)
Detected potential crypto function
Drops PE files
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Name Description Attribution Blogpost URLs Link
Amadey Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: nrKr2roAsG.exe Avira: detected
Antivirus detection for URL or domain
Source: http://176.113.115.6/Ni9kiput/index.php#3 Avira URL Cloud: Label: malware
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Found malware configuration
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp Malware Configuration Extractor: Amadey {"C2 url": "176.113.115.6/Ni9kiput/index.php", "Version": "5.21", "Install Folder": "bb556cff4a", "Install File": "rapes.exe"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe ReversingLabs: Detection: 63%
Multi AV Scanner detection for submitted file
Source: nrKr2roAsG.exe Virustotal: Detection: 55% Perma Link
Source: nrKr2roAsG.exe ReversingLabs: Detection: 63%
Joe Sandbox ML detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Sample uses string decryption to hide its real strings
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: 176.113.115.6
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: /Ni9kiput/index.php
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: S-%lu-
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: bb556cff4a
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: rapes.exe
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: Startup
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: cmd /C RMDIR /s/q
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: rundll32
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: Programs
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: %USERPROFILE%
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: cred.dll|clip.dll|
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: cred.dll
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: clip.dll
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: http://
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: https://
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: /quiet
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: /Plugins/
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: &unit=
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: shell32.dll
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: kernel32.dll
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: GetNativeSystemInfo
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: ProgramData\
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: AVAST Software
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: Kaspersky Lab
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: Panda Security
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: Doctor Web
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: 360TotalSecurity
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: Bitdefender
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: Norton
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: Sophos
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: Comodo
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: WinDefender
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: 0123456789
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: ------
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: ?scr=1
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: ComputerName
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: abcdefghijklmnopqrstuvwxyz0123456789-_
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: -unicode-
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: SYSTEM\ControlSet001\Services\BasicDisplay\Video
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: VideoID
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: DefaultSettings.XResolution
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: DefaultSettings.YResolution
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: ProductName
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: CurrentBuild
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: rundll32.exe
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: "taskkill /f /im "
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: " && timeout 1 && del
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: && Exit"
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: " && ren
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: Powershell.exe
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: -executionpolicy remotesigned -File "
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: shutdown -s -t 0
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: random
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: Keyboard Layout\Preload
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: 00000419
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: 00000422
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: 00000423
Source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String decryptor: 0000043f
Uses 32bit PE files
Source: nrKr2roAsG.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor IPs: 176.113.115.6
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 176.113.115.6 176.113.115.6
Source: Joe Sandbox View IP Address: 176.113.115.6 176.113.115.6
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: SELECTELRU SELECTELRU
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.4:49728 -> 176.113.115.6:80
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 10_2_00352710 recv,recv,recv,recv, 10_2_00352710
Source: rapes.exe, 0000000A.00000002.3661118709.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://176.113.115.6/Ni9kiput/index.php
Source: rapes.exe, 0000000A.00000002.3661118709.0000000000FBF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://176.113.115.6/Ni9kiput/index.php#3
Source: rapes.exe, 0000000A.00000002.3661118709.0000000000FBF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://176.113.115.6/Ni9kiput/index.php1
Source: rapes.exe, 0000000A.00000002.3661118709.0000000000FBF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://176.113.115.6/Ni9kiput/index.php33(
Source: rapes.exe, 0000000A.00000002.3661118709.0000000000FBF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://176.113.115.6/Ni9kiput/index.phpF3
Source: rapes.exe, 0000000A.00000002.3661118709.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://176.113.115.6/Ni9kiput/index.phpM
Source: rapes.exe, 0000000A.00000002.3661118709.0000000000FBF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://176.113.115.6/Ni9kiput/index.php~

System Summary
barindex
PE file contains section with special chars
Source: nrKr2roAsG.exe Static PE information: section name:
Source: nrKr2roAsG.exe Static PE information: section name: .idata
Source: nrKr2roAsG.exe Static PE information: section name:
Source: rapes.exe.0.dr Static PE information: section name:
Source: rapes.exe.0.dr Static PE information: section name: .idata
Source: rapes.exe.0.dr Static PE information: section name:
Abnormal high CPU Usage
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Process Stats: CPU usage > 49%
Creates files inside the system directory
Source: C:\Users\user\Desktop\nrKr2roAsG.exe File created: C:\Windows\Tasks\rapes.job Jump to behavior
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 10_2_003461F0 10_2_003461F0
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 10_2_0034B700 10_2_0034B700
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 10_2_00372C20 10_2_00372C20
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 10_2_00384047 10_2_00384047
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 10_2_00385CD4 10_2_00385CD4
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 10_2_003818D7 10_2_003818D7
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 10_2_0036B4C0 10_2_0036B4C0
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 10_2_003451A0 10_2_003451A0
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 10_2_00385DF4 10_2_00385DF4
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 10_2_00344EF0 10_2_00344EF0
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 10_2_0037C6DD 10_2_0037C6DD
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 10_2_0036F6DB 10_2_0036F6DB
Uses 32bit PE files
Source: nrKr2roAsG.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: nrKr2roAsG.exe Static PE information: Section: ZLIB complexity 0.9984450327134986
Source: nrKr2roAsG.exe Static PE information: Section: htvasuwj ZLIB complexity 0.9945291435739964
Source: rapes.exe.0.dr Static PE information: Section: ZLIB complexity 0.9984450327134986
Source: rapes.exe.0.dr Static PE information: Section: htvasuwj ZLIB complexity 0.9945291435739964
Source: rapes.exe.0.dr Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: nrKr2roAsG.exe Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@4/3@0/1
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Users\user\Desktop\nrKr2roAsG.exe File created: C:\Users\user\AppData\Local\Temp\bb556cff4a Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: nrKr2roAsG.exe Virustotal: Detection: 55%
Source: nrKr2roAsG.exe ReversingLabs: Detection: 63%
Source: nrKr2roAsG.exe String found in binary or memory: " /add
Source: nrKr2roAsG.exe String found in binary or memory: " /add /y
Source: nrKr2roAsG.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: rapes.exe String found in binary or memory: " /add
Source: rapes.exe String found in binary or memory: " /add /y
Source: rapes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: rapes.exe String found in binary or memory: " /add
Source: rapes.exe String found in binary or memory: " /add /y
Source: rapes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: C:\Users\user\Desktop\nrKr2roAsG.exe File read: C:\Users\user\Desktop\nrKr2roAsG.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\nrKr2roAsG.exe "C:\Users\user\Desktop\nrKr2roAsG.exe"
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe "C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe "C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe" Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: mstask.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: dui70.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: duser.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: chartv.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: atlthunk.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32 Jump to behavior
Source: nrKr2roAsG.exe Static file information: File size 1911808 > 1048576
Source: nrKr2roAsG.exe Static PE information: Raw size of htvasuwj is bigger than: 0x100000 < 0x1a1400

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Unpacked PE file: 0.2.nrKr2roAsG.exe.610000.0.unpack :EW;.rsrc:W;.idata :W; :EW;htvasuwj:EW;ollxpecm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;htvasuwj:EW;ollxpecm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Unpacked PE file: 2.2.rapes.exe.340000.0.unpack :EW;.rsrc:W;.idata :W; :EW;htvasuwj:EW;ollxpecm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;htvasuwj:EW;ollxpecm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Unpacked PE file: 10.2.rapes.exe.340000.0.unpack :EW;.rsrc:W;.idata :W; :EW;htvasuwj:EW;ollxpecm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;htvasuwj:EW;ollxpecm:EW;.taggant:EW;
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: rapes.exe.0.dr Static PE information: real checksum: 0x1db5da should be: 0x1e1647
Source: nrKr2roAsG.exe Static PE information: real checksum: 0x1db5da should be: 0x1e1647
PE file contains sections with non-standard names
Source: nrKr2roAsG.exe Static PE information: section name:
Source: nrKr2roAsG.exe Static PE information: section name: .idata
Source: nrKr2roAsG.exe Static PE information: section name:
Source: nrKr2roAsG.exe Static PE information: section name: htvasuwj
Source: nrKr2roAsG.exe Static PE information: section name: ollxpecm
Source: nrKr2roAsG.exe Static PE information: section name: .taggant
Source: rapes.exe.0.dr Static PE information: section name:
Source: rapes.exe.0.dr Static PE information: section name: .idata
Source: rapes.exe.0.dr Static PE information: section name:
Source: rapes.exe.0.dr Static PE information: section name: htvasuwj
Source: rapes.exe.0.dr Static PE information: section name: ollxpecm
Source: rapes.exe.0.dr Static PE information: section name: .taggant
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 10_2_00369FD5 push ecx; ret 10_2_00369FD4
Source: nrKr2roAsG.exe Static PE information: section name: entropy: 7.977798276251602
Source: nrKr2roAsG.exe Static PE information: section name: htvasuwj entropy: 7.953114284729685
Source: rapes.exe.0.dr Static PE information: section name: entropy: 7.977798276251602
Source: rapes.exe.0.dr Static PE information: section name: htvasuwj entropy: 7.953114284729685
Drops PE files
Source: C:\Users\user\Desktop\nrKr2roAsG.exe File created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Jump to dropped file

Boot Survival
barindex
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Creates job files (autostart)
Source: C:\Users\user\Desktop\nrKr2roAsG.exe File created: C:\Windows\Tasks\rapes.job Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\nrKr2roAsG.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 6834BE second address: 6834C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 6834C4 second address: 6834CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 805D53 second address: 805D5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 80501E second address: 805041 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCA8451F68Ah 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FCA8451F690h 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 805041 second address: 805045 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 805045 second address: 80504B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 805486 second address: 80548B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 80548B second address: 8054A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007FCA8451F68Fh 0x0000000b push esi 0x0000000c pop esi 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8054A7 second address: 8054AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8054AB second address: 8054B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 805606 second address: 805612 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 805612 second address: 805616 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 805616 second address: 805633 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FCA84722826h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jo 00007FCA84722832h 0x00000015 ja 00007FCA84722826h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 805633 second address: 80563A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 80563A second address: 805649 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 jns 00007FCA84722826h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 805649 second address: 805659 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007FCA8451F68Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 805659 second address: 80565D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 808788 second address: 80878E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 80878E second address: 808792 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 7E8FAE second address: 7E8FB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 7E8FB4 second address: 7E8FC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FCA84722826h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 827484 second address: 82748B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8282CA second address: 8282D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 828441 second address: 828461 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jo 00007FCA8451F686h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pop esi 0x0000000c pushad 0x0000000d jmp 00007FCA8451F691h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 828E51 second address: 828E55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 828E55 second address: 828E5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 829004 second address: 82902B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007FCA8472283Ah 0x0000000e jmp 00007FCA84722834h 0x00000013 pop ebx 0x00000014 pushad 0x00000015 push ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 82902B second address: 82904C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push esi 0x00000006 jmp 00007FCA8451F696h 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 82904C second address: 829065 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCA84722835h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8291A7 second address: 8291B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop ecx 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8291B1 second address: 8291B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8291B6 second address: 8291C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FCA8451F686h 0x0000000a jng 00007FCA8451F686h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8291C6 second address: 82921A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA8472282Eh 0x00000007 jmp 00007FCA84722832h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FCA84722838h 0x00000015 jmp 00007FCA84722836h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 82954C second address: 829577 instructions: 0x00000000 rdtsc 0x00000002 je 00007FCA8451F6A1h 0x00000008 jne 00007FCA8451F68Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 82EE01 second address: 82EE06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 82EE06 second address: 82EE21 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FCA8451F688h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FCA8451F68Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 82F581 second address: 82F585 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 83056C second address: 830570 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8306EF second address: 8306F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8341E6 second address: 8341EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8341EC second address: 8341F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 83439F second address: 8343A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8343A3 second address: 8343B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FCA84722826h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnp 00007FCA8472282Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 834AE4 second address: 834AF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push edi 0x00000006 pushad 0x00000007 popad 0x00000008 pop edi 0x00000009 pushad 0x0000000a jbe 00007FCA8451F686h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 837FF3 second address: 838010 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [eax] 0x00000007 jmp 00007FCA8472282Dh 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 838010 second address: 838014 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 838014 second address: 83802D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 pop eax 0x00000008 add dword ptr [ebp+122D1A0Fh], ebx 0x0000000e push D7F5397Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 push ebx 0x00000016 pushad 0x00000017 popad 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 83802D second address: 838032 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 83839E second address: 8383A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8383A4 second address: 8383A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8383A8 second address: 8383AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 83887B second address: 83887F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 838CD7 second address: 838CE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 838CE0 second address: 838CEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 838CEC second address: 838CF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 838E3C second address: 838E40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 838E40 second address: 838E50 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA8472282Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 838F05 second address: 838F0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 838F0A second address: 838F0F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 83920F second address: 839219 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FCA8451F686h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8392C1 second address: 8392FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCA84722833h 0x00000009 popad 0x0000000a pop edx 0x0000000b mov dword ptr [esp], eax 0x0000000e jnp 00007FCA8472282Ch 0x00000014 add dword ptr [ebp+122D1835h], edi 0x0000001a xchg eax, ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FCA84722832h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 83A187 second address: 83A1D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FCA8451F68Ch 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e mov esi, dword ptr [ebp+122D2D5Dh] 0x00000014 push 00000000h 0x00000016 mov dword ptr [ebp+12457441h], esi 0x0000001c push 00000000h 0x0000001e mov edi, 4ED9D4C1h 0x00000023 pushad 0x00000024 and ecx, 229B4EDBh 0x0000002a xor esi, dword ptr [ebp+122D3A63h] 0x00000030 popad 0x00000031 xchg eax, ebx 0x00000032 jl 00007FCA8451F68Ch 0x00000038 pushad 0x00000039 push edi 0x0000003a pop edi 0x0000003b pushad 0x0000003c popad 0x0000003d popad 0x0000003e push eax 0x0000003f push ebx 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 83B34E second address: 83B3C1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov esi, dword ptr [ebp+122D3A3Fh] 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ecx 0x00000016 call 00007FCA84722828h 0x0000001b pop ecx 0x0000001c mov dword ptr [esp+04h], ecx 0x00000020 add dword ptr [esp+04h], 00000015h 0x00000028 inc ecx 0x00000029 push ecx 0x0000002a ret 0x0000002b pop ecx 0x0000002c ret 0x0000002d mov di, ax 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push eax 0x00000035 call 00007FCA84722828h 0x0000003a pop eax 0x0000003b mov dword ptr [esp+04h], eax 0x0000003f add dword ptr [esp+04h], 0000001Dh 0x00000047 inc eax 0x00000048 push eax 0x00000049 ret 0x0000004a pop eax 0x0000004b ret 0x0000004c xor di, 2A22h 0x00000051 xchg eax, ebx 0x00000052 jmp 00007FCA8472282Dh 0x00000057 push eax 0x00000058 push ecx 0x00000059 push eax 0x0000005a push edx 0x0000005b push ecx 0x0000005c pop ecx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 83BE37 second address: 83BE7D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 and edi, 01136487h 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push eax 0x00000013 call 00007FCA8451F688h 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d add dword ptr [esp+04h], 00000017h 0x00000025 inc eax 0x00000026 push eax 0x00000027 ret 0x00000028 pop eax 0x00000029 ret 0x0000002a cld 0x0000002b push 00000000h 0x0000002d or esi, 168F32B4h 0x00000033 xchg eax, ebx 0x00000034 pushad 0x00000035 jns 00007FCA8451F688h 0x0000003b push eax 0x0000003c push edx 0x0000003d push edx 0x0000003e pop edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 83BE7D second address: 83BEAF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA84722830h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push edi 0x0000000f pop edi 0x00000010 jmp 00007FCA84722836h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 83BEAF second address: 83BEB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 83C89B second address: 83C89F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 83C89F second address: 83C914 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FCA8451F68Ch 0x0000000b popad 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007FCA8451F688h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 0000001Ah 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 mov dword ptr [ebp+122D2B83h], ebx 0x0000002d push 00000000h 0x0000002f xor dword ptr [ebp+124826D2h], ebx 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push edi 0x0000003a call 00007FCA8451F688h 0x0000003f pop edi 0x00000040 mov dword ptr [esp+04h], edi 0x00000044 add dword ptr [esp+04h], 0000001Ch 0x0000004c inc edi 0x0000004d push edi 0x0000004e ret 0x0000004f pop edi 0x00000050 ret 0x00000051 sbb si, 78B7h 0x00000056 xchg eax, ebx 0x00000057 push eax 0x00000058 push edx 0x00000059 push ecx 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 83C914 second address: 83C919 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 83C919 second address: 83C92A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 83E8C0 second address: 83E8CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FCA84722826h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 83E8CB second address: 83E8D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 83E8D1 second address: 83E8D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 83DBA0 second address: 83DBA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 83F04D second address: 83F051 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 83F051 second address: 83F055 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 844CF2 second address: 844CF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 842E89 second address: 842E8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 842E8D second address: 842EA9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA84722838h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 844E93 second address: 844F2A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA8451F695h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d movsx edi, bx 0x00000010 push dword ptr fs:[00000000h] 0x00000017 push 00000000h 0x00000019 push edi 0x0000001a call 00007FCA8451F688h 0x0000001f pop edi 0x00000020 mov dword ptr [esp+04h], edi 0x00000024 add dword ptr [esp+04h], 00000016h 0x0000002c inc edi 0x0000002d push edi 0x0000002e ret 0x0000002f pop edi 0x00000030 ret 0x00000031 mov dword ptr fs:[00000000h], esp 0x00000038 clc 0x00000039 mov eax, dword ptr [ebp+122D0525h] 0x0000003f mov dword ptr [ebp+1245757Eh], edi 0x00000045 jmp 00007FCA8451F68Ch 0x0000004a push FFFFFFFFh 0x0000004c push 00000000h 0x0000004e push ebp 0x0000004f call 00007FCA8451F688h 0x00000054 pop ebp 0x00000055 mov dword ptr [esp+04h], ebp 0x00000059 add dword ptr [esp+04h], 0000001Ch 0x00000061 inc ebp 0x00000062 push ebp 0x00000063 ret 0x00000064 pop ebp 0x00000065 ret 0x00000066 mov edi, 3D1D2155h 0x0000006b push eax 0x0000006c push eax 0x0000006d push edx 0x0000006e push eax 0x0000006f push edx 0x00000070 push eax 0x00000071 push edx 0x00000072 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 845E35 second address: 845E9B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA8472282Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d xor di, A3B8h 0x00000012 push dword ptr fs:[00000000h] 0x00000019 push 00000000h 0x0000001b push eax 0x0000001c call 00007FCA84722828h 0x00000021 pop eax 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 add dword ptr [esp+04h], 00000014h 0x0000002e inc eax 0x0000002f push eax 0x00000030 ret 0x00000031 pop eax 0x00000032 ret 0x00000033 mov dword ptr fs:[00000000h], esp 0x0000003a je 00007FCA8472282Ah 0x00000040 mov bx, A27Dh 0x00000044 mov eax, dword ptr [ebp+122D0099h] 0x0000004a cmc 0x0000004b push FFFFFFFFh 0x0000004d or di, B3B5h 0x00000052 push eax 0x00000053 push eax 0x00000054 push edx 0x00000055 pushad 0x00000056 jc 00007FCA84722826h 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 846C6A second address: 846D09 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FCA8451F686h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jne 00007FCA8451F68Eh 0x00000011 nop 0x00000012 jmp 00007FCA8451F694h 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push ecx 0x0000001c call 00007FCA8451F688h 0x00000021 pop ecx 0x00000022 mov dword ptr [esp+04h], ecx 0x00000026 add dword ptr [esp+04h], 0000001Dh 0x0000002e inc ecx 0x0000002f push ecx 0x00000030 ret 0x00000031 pop ecx 0x00000032 ret 0x00000033 push ecx 0x00000034 pop edi 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push ebp 0x0000003a call 00007FCA8451F688h 0x0000003f pop ebp 0x00000040 mov dword ptr [esp+04h], ebp 0x00000044 add dword ptr [esp+04h], 00000015h 0x0000004c inc ebp 0x0000004d push ebp 0x0000004e ret 0x0000004f pop ebp 0x00000050 ret 0x00000051 push ecx 0x00000052 or dword ptr [ebp+122D1F49h], ebx 0x00000058 pop ebx 0x00000059 mov ebx, dword ptr [ebp+122D38F3h] 0x0000005f xchg eax, esi 0x00000060 jmp 00007FCA8451F68Fh 0x00000065 push eax 0x00000066 push eax 0x00000067 push edx 0x00000068 push esi 0x00000069 jg 00007FCA8451F686h 0x0000006f pop esi 0x00000070 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 844F2A second address: 844F2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 845E9B second address: 845EA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 844F2E second address: 844F3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA8472282Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 846E88 second address: 846EA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCA8451F694h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 847CC8 second address: 847D77 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007FCA84722833h 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ebx 0x00000014 call 00007FCA84722828h 0x00000019 pop ebx 0x0000001a mov dword ptr [esp+04h], ebx 0x0000001e add dword ptr [esp+04h], 0000001Ch 0x00000026 inc ebx 0x00000027 push ebx 0x00000028 ret 0x00000029 pop ebx 0x0000002a ret 0x0000002b mov edi, ecx 0x0000002d jmp 00007FCA8472282Fh 0x00000032 push 00000000h 0x00000034 pushad 0x00000035 jmp 00007FCA84722839h 0x0000003a mov dword ptr [ebp+122D1987h], edi 0x00000040 popad 0x00000041 mov edi, dword ptr [ebp+122D29DEh] 0x00000047 push 00000000h 0x00000049 push 00000000h 0x0000004b push ecx 0x0000004c call 00007FCA84722828h 0x00000051 pop ecx 0x00000052 mov dword ptr [esp+04h], ecx 0x00000056 add dword ptr [esp+04h], 00000018h 0x0000005e inc ecx 0x0000005f push ecx 0x00000060 ret 0x00000061 pop ecx 0x00000062 ret 0x00000063 mov dword ptr [ebp+122D1965h], edi 0x00000069 xchg eax, esi 0x0000006a jo 00007FCA8472282Eh 0x00000070 push ecx 0x00000071 push eax 0x00000072 push edx 0x00000073 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 847D77 second address: 847D87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 jns 00007FCA8451F686h 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 848E90 second address: 848E94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 847EF9 second address: 847EFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 849120 second address: 849125 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 849125 second address: 84912A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 84A15A second address: 84A160 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 84A160 second address: 84A164 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 84CEFA second address: 84CF2A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FCA8472282Eh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 pop eax 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 jmp 00007FCA8472282Ch 0x0000001d push ebx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 7FED71 second address: 7FED91 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 jmp 00007FCA8451F691h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 7FED91 second address: 7FEDA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007FCA84722826h 0x0000000d jp 00007FCA84722826h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 7FEDA4 second address: 7FEDAE instructions: 0x00000000 rdtsc 0x00000002 je 00007FCA8451F686h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 7FEDAE second address: 7FEDB3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 7FEDB3 second address: 7FEDD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCA8451F694h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jnc 00007FCA8451F686h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 7FEDD8 second address: 7FEDDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 7FEDDC second address: 7FEDEC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA8451F68Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 84D4D7 second address: 84D4DC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 84D4DC second address: 84D561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 pushad 0x0000000a ja 00007FCA8451F686h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pop eax 0x00000014 nop 0x00000015 push 00000000h 0x00000017 push ebp 0x00000018 call 00007FCA8451F688h 0x0000001d pop ebp 0x0000001e mov dword ptr [esp+04h], ebp 0x00000022 add dword ptr [esp+04h], 00000015h 0x0000002a inc ebp 0x0000002b push ebp 0x0000002c ret 0x0000002d pop ebp 0x0000002e ret 0x0000002f mov edi, dword ptr [ebp+122D2CDFh] 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push edi 0x0000003a call 00007FCA8451F688h 0x0000003f pop edi 0x00000040 mov dword ptr [esp+04h], edi 0x00000044 add dword ptr [esp+04h], 0000001Ch 0x0000004c inc edi 0x0000004d push edi 0x0000004e ret 0x0000004f pop edi 0x00000050 ret 0x00000051 jmp 00007FCA8451F699h 0x00000056 push 00000000h 0x00000058 stc 0x00000059 push eax 0x0000005a je 00007FCA8451F694h 0x00000060 push eax 0x00000061 push edx 0x00000062 pushad 0x00000063 popad 0x00000064 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 84B026 second address: 84B034 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCA8472282Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 84B034 second address: 84B041 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 84D6F8 second address: 84D703 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 84D703 second address: 84D719 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FCA8451F68Dh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 84F6B3 second address: 84F6B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 84F83B second address: 84F845 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FCA8451F686h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 84F845 second address: 84F84F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FCA84722826h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 84F84F second address: 84F853 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 84F853 second address: 84F86C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jo 00007FCA84722826h 0x00000012 jng 00007FCA84722826h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 850814 second address: 850819 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 850819 second address: 850825 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 850825 second address: 850888 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 nop 0x00000007 mov bx, 7C9Dh 0x0000000b push dword ptr fs:[00000000h] 0x00000012 push 00000000h 0x00000014 push ebx 0x00000015 call 00007FCA8451F688h 0x0000001a pop ebx 0x0000001b mov dword ptr [esp+04h], ebx 0x0000001f add dword ptr [esp+04h], 00000018h 0x00000027 inc ebx 0x00000028 push ebx 0x00000029 ret 0x0000002a pop ebx 0x0000002b ret 0x0000002c xor dword ptr [ebp+12457591h], eax 0x00000032 mov dword ptr fs:[00000000h], esp 0x00000039 mov eax, dword ptr [ebp+122D1565h] 0x0000003f mov edi, dword ptr [ebp+122D2D81h] 0x00000045 push FFFFFFFFh 0x00000047 jmp 00007FCA8451F68Ch 0x0000004c push eax 0x0000004d jp 00007FCA8451F690h 0x00000053 pushad 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 85173B second address: 85173F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 85173F second address: 851745 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 853658 second address: 85365D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 85182F second address: 851839 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FCA8451F686h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 851839 second address: 85183D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 85365D second address: 8536EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FCA8451F694h 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f jmp 00007FCA8451F699h 0x00000014 jmp 00007FCA8451F691h 0x00000019 popad 0x0000001a nop 0x0000001b jmp 00007FCA8451F68Dh 0x00000020 push 00000000h 0x00000022 pushad 0x00000023 sub dword ptr [ebp+1247EDF5h], esi 0x00000029 mov al, 77h 0x0000002b popad 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push ecx 0x00000031 call 00007FCA8451F688h 0x00000036 pop ecx 0x00000037 mov dword ptr [esp+04h], ecx 0x0000003b add dword ptr [esp+04h], 0000001Bh 0x00000043 inc ecx 0x00000044 push ecx 0x00000045 ret 0x00000046 pop ecx 0x00000047 ret 0x00000048 stc 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d pushad 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 852808 second address: 85280E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 85280E second address: 852813 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 853842 second address: 853847 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8558FE second address: 855905 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 855905 second address: 855920 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c jmp 00007FCA8472282Eh 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 85B532 second address: 85B54D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FCA8451F690h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 85B54D second address: 85B563 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jng 00007FCA84722826h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007FCA84722826h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 85B563 second address: 85B58B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e jmp 00007FCA8451F68Bh 0x00000013 jmp 00007FCA8451F68Eh 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 85B58B second address: 85B591 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 85B591 second address: 85B597 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 85B07A second address: 85B080 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 85B080 second address: 85B0A9 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FCA8451F686h 0x00000008 jmp 00007FCA8451F697h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 85B0A9 second address: 85B0AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 85B0AD second address: 85B0B7 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FCA8451F686h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 863C91 second address: 863CA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jmp 00007FCA8472282Dh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 864242 second address: 86424E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jg 00007FCA8451F686h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 86424E second address: 864260 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FCA84722826h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 864260 second address: 864270 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FCA8451F686h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 86456C second address: 864571 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 864848 second address: 86485D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCA8451F68Fh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 864AC7 second address: 864AD1 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FCA8472282Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 864C10 second address: 864C30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCA8451F695h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 864C30 second address: 864C34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 864D98 second address: 864DA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ecx 0x00000006 jnp 00007FCA8451F686h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 864DA6 second address: 864DB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jl 00007FCA84722826h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8665A1 second address: 8665A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8665A9 second address: 8665AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 7EC418 second address: 7EC46D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA8451F696h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jg 00007FCA8451F686h 0x00000012 jmp 00007FCA8451F697h 0x00000017 popad 0x00000018 pushad 0x00000019 jng 00007FCA8451F696h 0x0000001f jmp 00007FCA8451F690h 0x00000024 push esi 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 86B654 second address: 86B65B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 86B65B second address: 86B676 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCA8451F695h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8369B4 second address: 8369BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 836FBE second address: 837022 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007FCA8451F68Ch 0x0000000c popad 0x0000000d xor dword ptr [esp], 6DD4F567h 0x00000014 push 00000000h 0x00000016 push esi 0x00000017 call 00007FCA8451F688h 0x0000001c pop esi 0x0000001d mov dword ptr [esp+04h], esi 0x00000021 add dword ptr [esp+04h], 00000019h 0x00000029 inc esi 0x0000002a push esi 0x0000002b ret 0x0000002c pop esi 0x0000002d ret 0x0000002e mov dword ptr [ebp+122D188Ch], edx 0x00000034 push 41F06338h 0x00000039 jnp 00007FCA8451F6A4h 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007FCA8451F696h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 837094 second address: 8370C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007FCA84722839h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FCA8472282Dh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 83713F second address: 83719F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCA8451F68Ch 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007FCA8451F68Bh 0x00000010 jbe 00007FCA8451F686h 0x00000016 popad 0x00000017 popad 0x00000018 mov dword ptr [esp], esi 0x0000001b push 00000000h 0x0000001d push ecx 0x0000001e call 00007FCA8451F688h 0x00000023 pop ecx 0x00000024 mov dword ptr [esp+04h], ecx 0x00000028 add dword ptr [esp+04h], 0000001Ch 0x00000030 inc ecx 0x00000031 push ecx 0x00000032 ret 0x00000033 pop ecx 0x00000034 ret 0x00000035 push eax 0x00000036 pushad 0x00000037 pushad 0x00000038 ja 00007FCA8451F686h 0x0000003e ja 00007FCA8451F686h 0x00000044 popad 0x00000045 push eax 0x00000046 push edx 0x00000047 push edi 0x00000048 pop edi 0x00000049 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 837326 second address: 83732C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 83732C second address: 837346 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FCA8451F695h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 837BB3 second address: 837BC8 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FCA84722826h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c jng 00007FCA84722834h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 837BC8 second address: 837BCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 837BCE second address: 837C12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push ecx 0x00000009 call 00007FCA84722828h 0x0000000e pop ecx 0x0000000f mov dword ptr [esp+04h], ecx 0x00000013 add dword ptr [esp+04h], 00000019h 0x0000001b inc ecx 0x0000001c push ecx 0x0000001d ret 0x0000001e pop ecx 0x0000001f ret 0x00000020 lea eax, dword ptr [ebp+12487660h] 0x00000026 push eax 0x00000027 jng 00007FCA8472283Ch 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007FCA8472282Eh 0x00000034 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 86B1FB second address: 86B20B instructions: 0x00000000 rdtsc 0x00000002 jng 00007FCA8451F686h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 86FA91 second address: 86FAA7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jne 00007FCA84722826h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 pop edx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 86FAA7 second address: 86FAAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 86FDA6 second address: 86FDAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 86FDAA second address: 86FDC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FCA8451F691h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 86FDC1 second address: 86FDC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 86FDC7 second address: 86FDCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 86FDCB second address: 86FDFF instructions: 0x00000000 rdtsc 0x00000002 jc 00007FCA84722826h 0x00000008 jp 00007FCA84722826h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007FCA8472282Dh 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FCA84722830h 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 86FDFF second address: 86FE04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 86FE04 second address: 86FE1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCA84722834h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 86FE1E second address: 86FE22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 86FF9A second address: 86FFA2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 86FFA2 second address: 86FFA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 86FFA8 second address: 86FFC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCA84722834h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 870247 second address: 87024D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 87024D second address: 870251 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 870251 second address: 87025D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 87025D second address: 870274 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCA84722833h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 870274 second address: 8702AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA8451F699h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007FCA8451F696h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8702AD second address: 8702B7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8702B7 second address: 8702BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8702BB second address: 8702DE instructions: 0x00000000 rdtsc 0x00000002 jp 00007FCA84722826h 0x00000008 jmp 00007FCA84722835h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8702DE second address: 8702E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8702E2 second address: 8702E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 870469 second address: 87047C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCA8451F68Dh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8705F7 second address: 87061D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FCA84722826h 0x00000008 jmp 00007FCA84722838h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 876BC4 second address: 876BCA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 87588D second address: 875891 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 875AFB second address: 875B15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 ja 00007FCA8451F686h 0x0000000c popad 0x0000000d push edx 0x0000000e jnc 00007FCA8451F686h 0x00000014 pushad 0x00000015 popad 0x00000016 pop edx 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 875B15 second address: 875B36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCA84722839h 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 875B36 second address: 875B54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007FCA8451F69Dh 0x0000000b jmp 00007FCA8451F691h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 875B54 second address: 875B7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 push edx 0x00000009 pop edx 0x0000000a jno 00007FCA84722826h 0x00000010 jmp 00007FCA8472282Ch 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jng 00007FCA84722826h 0x0000001e push eax 0x0000001f pop eax 0x00000020 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 875B7B second address: 875B99 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA8451F698h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 875D11 second address: 875D17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 875D17 second address: 875D24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 875D24 second address: 875D59 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA84722837h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jng 00007FCA8472282Ah 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FCA8472282Eh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 876046 second address: 87604A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 876323 second address: 876331 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FCA84722828h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 876331 second address: 876335 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 876490 second address: 876494 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 876494 second address: 8764B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA8451F694h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8764B1 second address: 8764C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 jmp 00007FCA8472282Eh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 87661B second address: 876622 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 876622 second address: 87662F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jng 00007FCA84722826h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 87662F second address: 876634 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 876634 second address: 876652 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FCA84722826h 0x0000000a jne 00007FCA84722826h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FCA8472282Bh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 87CE50 second address: 87CE55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 87CE55 second address: 87CE62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 87FD85 second address: 87FD8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 87FD8B second address: 87FD97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jg 00007FCA84722826h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 87FD97 second address: 87FD9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 87FD9B second address: 87FDA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 87FDA1 second address: 87FDA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 87FDA6 second address: 87FDAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 87FDAC second address: 87FDB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 87F937 second address: 87F94C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007FCA84722826h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jnp 00007FCA84722826h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 881F1E second address: 881F2A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007FCA8451F686h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 881F2A second address: 881F54 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FCA8472282Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b jmp 00007FCA84722833h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 88746A second address: 88747B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jl 00007FCA8451F69Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 88747B second address: 88747F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 887609 second address: 88762A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA8451F68Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FCA8451F68Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 88762A second address: 887653 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FCA84722832h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FCA8472282Dh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 887653 second address: 88767E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA8451F697h 0x00000007 jmp 00007FCA8451F690h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 88767E second address: 887684 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 887993 second address: 8879AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA8451F693h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8879AF second address: 8879B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8879B6 second address: 8879BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 887C94 second address: 887CC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jnp 00007FCA8472282Ch 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FCA8472282Ah 0x00000015 pushad 0x00000016 jmp 00007FCA8472282Dh 0x0000001b push ecx 0x0000001c pop ecx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 887CC6 second address: 887CCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 887CCB second address: 887CD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 887CD1 second address: 887CD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 7EDF87 second address: 7EDF8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 7EDF8D second address: 7EDF91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 88A77D second address: 88A781 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 88A781 second address: 88A799 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCA8451F68Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 88A799 second address: 88A79F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 88A79F second address: 88A7BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA8451F68Ch 0x00000007 jmp 00007FCA8451F68Fh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 88A7BE second address: 88A7C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 88A7C6 second address: 88A7CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 88A921 second address: 88A927 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 88A927 second address: 88A944 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCA8451F699h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 891497 second address: 8914AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA84722832h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 890029 second address: 89002D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 89002D second address: 890033 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 890033 second address: 89003D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 890360 second address: 89036C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007FCA84722826h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8904C6 second address: 8904CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8904CA second address: 8904FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FCA8472282Dh 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 popad 0x00000016 push ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FCA84722830h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8904FB second address: 8904FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 837637 second address: 83763F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 83763F second address: 83766F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 nop 0x00000007 add dword ptr [ebp+122D28EEh], edi 0x0000000d mov ebx, dword ptr [ebp+1248765Bh] 0x00000013 mov dword ptr [ebp+122D2AA2h], edi 0x00000019 mov edx, dword ptr [ebp+122D39C3h] 0x0000001f add eax, ebx 0x00000021 mov edi, esi 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 jbe 00007FCA8451F686h 0x0000002d pushad 0x0000002e popad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 83766F second address: 837679 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FCA84722826h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 837679 second address: 8376B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA8451F68Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e mov edi, dword ptr [ebp+122D18A9h] 0x00000014 jmp 00007FCA8451F693h 0x00000019 push 00000004h 0x0000001b xor dword ptr [ebp+122D2E00h], ebx 0x00000021 nop 0x00000022 push eax 0x00000023 push edx 0x00000024 jc 00007FCA8451F688h 0x0000002a push edi 0x0000002b pop edi 0x0000002c rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8376B9 second address: 8376BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 899B62 second address: 899B6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 897BCB second address: 897BDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jno 00007FCA84722826h 0x0000000c popad 0x0000000d pop esi 0x0000000e pushad 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 897BDF second address: 897BF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 pushad 0x0000000a jc 00007FCA8451F686h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8983D4 second address: 8983F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c jmp 00007FCA84722830h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8983F1 second address: 8983F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8983F7 second address: 8983FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8983FB second address: 8983FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8983FF second address: 898405 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 89868A second address: 89868E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 898C70 second address: 898C91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCA84722839h 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8997F7 second address: 89982C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FCA8451F68Ah 0x0000000b popad 0x0000000c jbe 00007FCA8451F6A4h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 89E5C5 second address: 89E5FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA84722838h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FCA8472282Bh 0x0000000e popad 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FCA8472282Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 89E5FE second address: 89E602 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 89DE59 second address: 89DE84 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FCA8472282Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FCA8472282Eh 0x00000012 jne 00007FCA84722826h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 89DE84 second address: 89DE94 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push edi 0x00000008 jp 00007FCA8451F686h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 89E19C second address: 89E1A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 89E1A2 second address: 89E1B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FCA8451F686h 0x0000000a je 00007FCA8451F686h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 89E316 second address: 89E31F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 89E31F second address: 89E325 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 89E325 second address: 89E337 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007FCA84722826h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 89E337 second address: 89E33B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8A418B second address: 8A41C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007FCA84722828h 0x0000000c popad 0x0000000d jbe 00007FCA8472285Ah 0x00000013 jns 00007FCA8472282Eh 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FCA8472282Eh 0x00000020 jc 00007FCA84722826h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8A41C4 second address: 8A41C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8A41C8 second address: 8A41CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 7F9B0E second address: 7F9B1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FCA8451F686h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8A57E2 second address: 8A57FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007FCA84722828h 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 jo 00007FCA84722826h 0x00000016 jbe 00007FCA84722826h 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8AE8A7 second address: 8AE8B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FCA8451F686h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8AE8B2 second address: 8AE8B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8AE8B9 second address: 8AE8C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8AE8C6 second address: 8AE8CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8AE8CC second address: 8AE8D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8AE8D8 second address: 8AE8ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCA84722831h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8AE8ED second address: 8AE904 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA8451F68Dh 0x00000007 jnp 00007FCA8451F686h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8AE904 second address: 8AE909 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8ACF73 second address: 8ACFB3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA8451F694h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnp 00007FCA8451F692h 0x0000000f jl 00007FCA8451F68Ch 0x00000015 jnl 00007FCA8451F686h 0x0000001b push eax 0x0000001c push edx 0x0000001d jng 00007FCA8451F686h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8ACFB3 second address: 8ACFB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8AD124 second address: 8AD12D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8AD4C9 second address: 8AD4CE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8ADFED second address: 8ADFFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCA8451F68Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8AE72B second address: 8AE733 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8AE733 second address: 8AE737 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8B3B9B second address: 8B3BAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 jbe 00007FCA84722826h 0x0000000b jnp 00007FCA84722826h 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8B3BAD second address: 8B3BB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FCA8451F686h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8B3BB7 second address: 8B3BCE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA84722833h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8B3ED6 second address: 8B3EDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8B3EDA second address: 8B3EF6 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FCA84722828h 0x00000008 push eax 0x00000009 push edx 0x0000000a jp 00007FCA84722826h 0x00000010 jmp 00007FCA8472282Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8C0E0F second address: 8C0E17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8C0E17 second address: 8C0E1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8C0F76 second address: 8C0F85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCA8451F68Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8C532B second address: 8C533A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop eax 0x00000007 jng 00007FCA8472282Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8C533A second address: 8C5340 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8C5340 second address: 8C534A instructions: 0x00000000 rdtsc 0x00000002 js 00007FCA8472282Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8D30CA second address: 8D30D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FCA8451F686h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8D30D4 second address: 8D3100 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FCA84722826h 0x00000008 jmp 00007FCA84722830h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jng 00007FCA84722832h 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007FCA8472282Ah 0x0000001c rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8D3100 second address: 8D3105 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8D3105 second address: 8D3124 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pop edx 0x0000000e jo 00007FCA8472282Eh 0x00000014 jl 00007FCA84722826h 0x0000001a push esi 0x0000001b pop esi 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8D3124 second address: 8D312E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8DBA2C second address: 8DBA31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8DA6FC second address: 8DA715 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FCA8451F686h 0x0000000a jmp 00007FCA8451F68Fh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8DAB27 second address: 8DAB2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8DB743 second address: 8DB764 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FCA8451F698h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8DB764 second address: 8DB768 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8DB768 second address: 8DB786 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCA8451F695h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8DE743 second address: 8DE75A instructions: 0x00000000 rdtsc 0x00000002 jg 00007FCA8472282Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8DE75A second address: 8DE760 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8DE760 second address: 8DE770 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jo 00007FCA84722826h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8EA57C second address: 8EA597 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FCA8451F691h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8EA597 second address: 8EA59B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8F5893 second address: 8F589C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8F589C second address: 8F58B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCA84722834h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8F6DE2 second address: 8F6E1E instructions: 0x00000000 rdtsc 0x00000002 jo 00007FCA8451F686h 0x00000008 jmp 00007FCA8451F698h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jbe 00007FCA8451F69Ah 0x00000015 jmp 00007FCA8451F694h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8F6E1E second address: 8F6E25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8F1E03 second address: 8F1E39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jp 00007FCA8451F686h 0x00000009 jmp 00007FCA8451F698h 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007FCA8451F68Dh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 8F1E39 second address: 8F1E53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FCA8472282Fh 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 904C70 second address: 904C76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 91C203 second address: 91C249 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FCA84722826h 0x00000009 jmp 00007FCA84722832h 0x0000000e jmp 00007FCA84722836h 0x00000013 popad 0x00000014 pushad 0x00000015 jmp 00007FCA84722831h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 91AF33 second address: 91AF46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jl 00007FCA8451F686h 0x0000000d js 00007FCA8451F686h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 91AF46 second address: 91AF4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 91B3A8 second address: 91B3AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 91B3AC second address: 91B3D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA84722835h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FCA8472282Fh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 91B3D4 second address: 91B3F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FCA8451F695h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 91B3F0 second address: 91B40C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007FCA84722838h 0x0000000f push ecx 0x00000010 pushad 0x00000011 popad 0x00000012 js 00007FCA84722826h 0x00000018 pop ecx 0x00000019 push edi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 91B564 second address: 91B56A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 91B89B second address: 91B8D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jc 00007FCA84722826h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 jo 00007FCA8472283Ch 0x0000001b pushad 0x0000001c popad 0x0000001d jmp 00007FCA84722834h 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 push ecx 0x00000028 pop ecx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 91B8D3 second address: 91B906 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FCA8451F68Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007FCA8451F696h 0x00000011 jl 00007FCA8451F686h 0x00000017 push esi 0x00000018 pop esi 0x00000019 push edi 0x0000001a pop edi 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 91BC1E second address: 91BC4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 push edx 0x00000009 pop edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 popad 0x00000011 push eax 0x00000012 jmp 00007FCA8472282Ch 0x00000017 jmp 00007FCA8472282Fh 0x0000001c pop eax 0x0000001d rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 91BD86 second address: 91BD8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 91BF13 second address: 91BF17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 91F234 second address: 91F279 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FCA8451F68Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jmp 00007FCA8451F693h 0x00000013 mov eax, dword ptr [eax] 0x00000015 jmp 00007FCA8451F693h 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 91F279 second address: 91F284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FCA84722826h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 920545 second address: 920576 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jne 00007FCA8451F698h 0x0000000b popad 0x0000000c pushad 0x0000000d jc 00007FCA8451F68Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 9220A8 second address: 9220B9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 pushad 0x00000009 jnl 00007FCA84722826h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 9220B9 second address: 9220CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jng 00007FCA8451F68Eh 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 923A51 second address: 923A57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 923A57 second address: 923A5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 923A5B second address: 923A70 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FCA8472282Bh 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 923A70 second address: 923A9F instructions: 0x00000000 rdtsc 0x00000002 jl 00007FCA8451F686h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FCA8451F699h 0x00000012 push edi 0x00000013 jbe 00007FCA8451F686h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 923A9F second address: 923AA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 923AA4 second address: 923ABE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FCA8451F691h 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 923ABE second address: 923AD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FCA8472282Eh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49F0E30 second address: 49F0E78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA8451F691h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FCA8451F68Ah 0x00000012 pushfd 0x00000013 jmp 00007FCA8451F692h 0x00000018 xor cx, EBD8h 0x0000001d jmp 00007FCA8451F68Bh 0x00000022 popfd 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49F0E78 second address: 49F0E8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 0AFAh 0x00000007 mov dx, DCC6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 mov ecx, ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49F0E8C second address: 49F0EF0 instructions: 0x00000000 rdtsc 0x00000002 call 00007FCA8451F695h 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a call 00007FCA8451F691h 0x0000000f mov ecx, 2A962357h 0x00000014 pop eax 0x00000015 popad 0x00000016 mov ebp, esp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007FCA8451F694h 0x00000021 and eax, 0BC7DAF8h 0x00000027 jmp 00007FCA8451F68Bh 0x0000002c popfd 0x0000002d mov eax, 7ACAF82Fh 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49F0EF0 second address: 49F0F22 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA84722835h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007FCA84722833h 0x00000012 pop esi 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49F0F22 second address: 49F0F28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A40206 second address: 4A40248 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA84722831h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov dh, E5h 0x0000000f pushfd 0x00000010 jmp 00007FCA84722834h 0x00000015 sbb ax, 4C68h 0x0000001a jmp 00007FCA8472282Bh 0x0000001f popfd 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49B0C72 second address: 49B0C76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49B0C76 second address: 49B0C7C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49B0C7C second address: 49B0C82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49B0C82 second address: 49B0C86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49B0C86 second address: 49B0D19 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA8451F68Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FCA8451F68Eh 0x00000011 mov ebp, esp 0x00000013 pushad 0x00000014 pushad 0x00000015 jmp 00007FCA8451F68Ch 0x0000001a jmp 00007FCA8451F692h 0x0000001f popad 0x00000020 mov si, E0A1h 0x00000024 popad 0x00000025 push dword ptr [ebp+04h] 0x00000028 pushad 0x00000029 pushfd 0x0000002a jmp 00007FCA8451F68Ah 0x0000002f sub ah, 00000038h 0x00000032 jmp 00007FCA8451F68Bh 0x00000037 popfd 0x00000038 mov si, 926Fh 0x0000003c popad 0x0000003d push dword ptr [ebp+0Ch] 0x00000040 jmp 00007FCA8451F692h 0x00000045 push dword ptr [ebp+08h] 0x00000048 push eax 0x00000049 push edx 0x0000004a push eax 0x0000004b push edx 0x0000004c jmp 00007FCA8451F68Ah 0x00000051 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49B0D19 second address: 49B0D1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49B0D1F second address: 49B0D30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCA8451F68Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49B0D56 second address: 49B0D71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCA84722837h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49F0BFC second address: 49F0C1A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA8451F691h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b movzx ecx, bx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49F0C1A second address: 49F0C6E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA84722835h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jmp 00007FCA84722831h 0x00000010 xchg eax, ebp 0x00000011 jmp 00007FCA8472282Eh 0x00000016 mov ebp, esp 0x00000018 jmp 00007FCA84722830h 0x0000001d pop ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49F0C6E second address: 49F0C72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49F0C72 second address: 49F0C78 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49F0C78 second address: 49F0C87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCA8451F68Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49F0C87 second address: 49F0C8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A30893 second address: 4A30897 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A30897 second address: 4A3089D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A3089D second address: 4A30903 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA8451F68Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FCA8451F691h 0x00000011 jmp 00007FCA8451F68Bh 0x00000016 popfd 0x00000017 pushfd 0x00000018 jmp 00007FCA8451F698h 0x0000001d or ecx, 2CBCBB78h 0x00000023 jmp 00007FCA8451F68Bh 0x00000028 popfd 0x00000029 popad 0x0000002a xchg eax, ebp 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e mov ebx, 1C01AD66h 0x00000033 pushad 0x00000034 popad 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A30903 second address: 4A3094E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA8472282Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FCA8472282Eh 0x00000012 add eax, 78DBE508h 0x00000018 jmp 00007FCA8472282Bh 0x0000001d popfd 0x0000001e mov ecx, 27DE2F7Fh 0x00000023 popad 0x00000024 pop ebp 0x00000025 pushad 0x00000026 mov di, cx 0x00000029 call 00007FCA8472282Ch 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A30865 second address: 4A3086E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 0622h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A30BF0 second address: 4A30BF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A30BF4 second address: 4A30BFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A30BFA second address: 4A30C1E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA8472282Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FCA8472282Bh 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 mov dl, ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A30C1E second address: 4A30C79 instructions: 0x00000000 rdtsc 0x00000002 mov eax, ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov cx, bx 0x00000009 popad 0x0000000a mov ebp, esp 0x0000000c pushad 0x0000000d call 00007FCA8451F68Bh 0x00000012 jmp 00007FCA8451F698h 0x00000017 pop eax 0x00000018 push ebx 0x00000019 push esi 0x0000001a pop ebx 0x0000001b pop ecx 0x0000001c popad 0x0000001d mov eax, dword ptr [ebp+08h] 0x00000020 jmp 00007FCA8451F699h 0x00000025 and dword ptr [eax], 00000000h 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A30C79 second address: 4A30C7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A30C7D second address: 4A30C83 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A30C83 second address: 4A30C98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCA84722831h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A30C98 second address: 4A30CC2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA8451F691h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b and dword ptr [eax+04h], 00000000h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FCA8451F68Dh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A30CC2 second address: 4A30CC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A30CC8 second address: 4A30CCC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49E08EA second address: 49E0939 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, A5C2h 0x00000007 call 00007FCA84722833h 0x0000000c pop ecx 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push esi 0x00000011 jmp 00007FCA84722834h 0x00000016 mov dword ptr [esp], ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FCA84722837h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49E0939 second address: 49E093F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A30006 second address: 4A300B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007FCA84722838h 0x0000000a popad 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FCA8472282Eh 0x00000013 jmp 00007FCA84722835h 0x00000018 popfd 0x00000019 call 00007FCA84722830h 0x0000001e jmp 00007FCA84722832h 0x00000023 pop ecx 0x00000024 popad 0x00000025 push eax 0x00000026 pushad 0x00000027 mov di, cx 0x0000002a popad 0x0000002b xchg eax, ebp 0x0000002c jmp 00007FCA84722834h 0x00000031 mov ebp, esp 0x00000033 jmp 00007FCA84722830h 0x00000038 pop ebp 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007FCA84722837h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A300B6 second address: 4A300BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A300BC second address: 4A300C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A30A14 second address: 4A30A18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A30A18 second address: 4A30A1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A30A1C second address: 4A30A22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A30A22 second address: 4A30A28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A30A28 second address: 4A30A2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A30A2C second address: 4A30A61 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA8472282Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FCA84722830h 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FCA8472282Dh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A30A61 second address: 4A30A76 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA8451F691h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A10D14 second address: 4A10D94 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA84722839h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FCA84722831h 0x0000000f xchg eax, ebp 0x00000010 jmp 00007FCA8472282Eh 0x00000015 mov ebp, esp 0x00000017 pushad 0x00000018 mov edi, eax 0x0000001a push esi 0x0000001b mov si, dx 0x0000001e pop edx 0x0000001f popad 0x00000020 mov eax, dword ptr [ebp+08h] 0x00000023 jmp 00007FCA84722830h 0x00000028 and dword ptr [eax], 00000000h 0x0000002b pushad 0x0000002c jmp 00007FCA8472282Eh 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007FCA84722830h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A00B09 second address: 4A00B2D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA8451F699h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop eax 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A00B2D second address: 4A00B33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A00B33 second address: 4A00B52 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FCA8451F694h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A00B52 second address: 4A00B57 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A00B57 second address: 4A00BA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movsx edi, cx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b jmp 00007FCA8451F696h 0x00000010 mov ebp, esp 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007FCA8451F68Dh 0x0000001b or cx, 0436h 0x00000020 jmp 00007FCA8451F691h 0x00000025 popfd 0x00000026 mov cx, 9427h 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49C0225 second address: 49C0258 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA84722839h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FCA8472282Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49C0258 second address: 49C025C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49C025C second address: 49C0262 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49C0262 second address: 49C0294 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA8451F68Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FCA8451F696h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49C0294 second address: 49C029A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49C0390 second address: 49C0396 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49C0396 second address: 49C039A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49C039A second address: 49C03EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 pushad 0x0000000a mov ecx, 41650C41h 0x0000000f call 00007FCA8451F68Eh 0x00000014 movzx esi, dx 0x00000017 pop edi 0x00000018 popad 0x00000019 mov dword ptr [esp], edi 0x0000001c jmp 00007FCA8451F68Ah 0x00000021 test esi, esi 0x00000023 jmp 00007FCA8451F690h 0x00000028 je 00007FCAF72DD8C0h 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007FCA8451F68Ah 0x00000037 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49C03EF second address: 49C03F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49C03F3 second address: 49C03F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49C03F9 second address: 49C040A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCA8472282Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49C040A second address: 49C046D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000000f jmp 00007FCA8451F68Dh 0x00000014 je 00007FCAF72DD88Bh 0x0000001a jmp 00007FCA8451F68Eh 0x0000001f mov edx, dword ptr [esi+44h] 0x00000022 pushad 0x00000023 mov bx, si 0x00000026 push eax 0x00000027 push edx 0x00000028 pushfd 0x00000029 jmp 00007FCA8451F698h 0x0000002e adc cx, F3D8h 0x00000033 jmp 00007FCA8451F68Bh 0x00000038 popfd 0x00000039 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49C046D second address: 49C04A5 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FCA84722838h 0x00000008 xor ax, 3E38h 0x0000000d jmp 00007FCA8472282Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 or edx, dword ptr [ebp+0Ch] 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49C04A5 second address: 49C04AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49C04AB second address: 49C0521 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, ah 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a test edx, 61000000h 0x00000010 jmp 00007FCA84722831h 0x00000015 jne 00007FCAF74E09E2h 0x0000001b pushad 0x0000001c push esi 0x0000001d pushad 0x0000001e popad 0x0000001f pop ebx 0x00000020 mov dx, si 0x00000023 popad 0x00000024 test byte ptr [esi+48h], 00000001h 0x00000028 jmp 00007FCA84722830h 0x0000002d jne 00007FCAF74E09D8h 0x00000033 jmp 00007FCA84722830h 0x00000038 test bl, 00000007h 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007FCA84722837h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49F0021 second address: 49F0030 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA8451F68Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49F0030 second address: 49F006B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA84722839h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushfd 0x0000000e jmp 00007FCA8472282Dh 0x00000013 jmp 00007FCA8472282Bh 0x00000018 popfd 0x00000019 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49F006B second address: 49F0160 instructions: 0x00000000 rdtsc 0x00000002 movzx esi, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ebx 0x00000008 mov esi, 66C535E7h 0x0000000d pop esi 0x0000000e popad 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FCA8451F699h 0x00000017 sub eax, 64044106h 0x0000001d jmp 00007FCA8451F691h 0x00000022 popfd 0x00000023 jmp 00007FCA8451F690h 0x00000028 popad 0x00000029 mov ebp, esp 0x0000002b jmp 00007FCA8451F690h 0x00000030 and esp, FFFFFFF8h 0x00000033 pushad 0x00000034 mov bh, al 0x00000036 pushfd 0x00000037 jmp 00007FCA8451F693h 0x0000003c sub cx, 259Eh 0x00000041 jmp 00007FCA8451F699h 0x00000046 popfd 0x00000047 popad 0x00000048 xchg eax, ebx 0x00000049 pushad 0x0000004a pushfd 0x0000004b jmp 00007FCA8451F68Ch 0x00000050 add ah, FFFFFF98h 0x00000053 jmp 00007FCA8451F68Bh 0x00000058 popfd 0x00000059 call 00007FCA8451F698h 0x0000005e mov ah, FEh 0x00000060 pop edi 0x00000061 popad 0x00000062 push eax 0x00000063 push eax 0x00000064 push edx 0x00000065 jmp 00007FCA8451F698h 0x0000006a rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49F0160 second address: 49F0206 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FCA8472282Fh 0x00000012 add eax, 1C26DB1Eh 0x00000018 jmp 00007FCA84722839h 0x0000001d popfd 0x0000001e pushfd 0x0000001f jmp 00007FCA84722830h 0x00000024 jmp 00007FCA84722835h 0x00000029 popfd 0x0000002a popad 0x0000002b xchg eax, esi 0x0000002c jmp 00007FCA8472282Eh 0x00000031 push eax 0x00000032 pushad 0x00000033 mov eax, ebx 0x00000035 mov edi, 1D065990h 0x0000003a popad 0x0000003b xchg eax, esi 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f pushfd 0x00000040 jmp 00007FCA84722830h 0x00000045 sbb eax, 63532DD8h 0x0000004b jmp 00007FCA8472282Bh 0x00000050 popfd 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49F0206 second address: 49F020B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49F020B second address: 49F0242 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FCA84722835h 0x00000008 call 00007FCA84722830h 0x0000000d pop eax 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov esi, dword ptr [ebp+08h] 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov ebx, esi 0x00000019 mov ebx, esi 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49F0385 second address: 49F038B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49F038B second address: 49F038F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49F038F second address: 49F0393 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49F0393 second address: 49F03A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push esi 0x0000000b mov bh, 56h 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 mov di, A574h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49F03A7 second address: 49F03FD instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FCA8451F68Dh 0x00000008 or ecx, 244FF336h 0x0000000e jmp 00007FCA8451F691h 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 mov dword ptr [esp], ebx 0x0000001a jmp 00007FCA8451F68Eh 0x0000001f xchg eax, ebx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FCA8451F697h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49F03FD second address: 49F0450 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FCA8472282Fh 0x00000008 mov di, cx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 push edi 0x00000011 pushfd 0x00000012 jmp 00007FCA8472282Eh 0x00000017 sub ch, 00000018h 0x0000001a jmp 00007FCA8472282Bh 0x0000001f popfd 0x00000020 pop ecx 0x00000021 mov di, E85Ch 0x00000025 popad 0x00000026 xchg eax, ebx 0x00000027 jmp 00007FCA8472282Bh 0x0000002c push dword ptr [ebp+14h] 0x0000002f pushad 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49F0450 second address: 49F0465 instructions: 0x00000000 rdtsc 0x00000002 mov si, 69B7h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov di, cx 0x0000000b popad 0x0000000c push dword ptr [ebp+10h] 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49F0465 second address: 49F0480 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA84722837h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49F04BB second address: 49F04D4 instructions: 0x00000000 rdtsc 0x00000002 mov esi, 7D9E627Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov esp, ebp 0x0000000c pushad 0x0000000d mov eax, 5DF5AE4Fh 0x00000012 popad 0x00000013 pop ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49F04D4 second address: 49F04D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49E0237 second address: 49E023E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49E023E second address: 49E0278 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA84722839h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FCA84722838h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49E0278 second address: 49E0287 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA8451F68Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49E0287 second address: 49E02E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA84722839h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FCA84722833h 0x00000012 sub ch, FFFFFFAEh 0x00000015 jmp 00007FCA84722839h 0x0000001a popfd 0x0000001b popad 0x0000001c pop ebp 0x0000001d pushad 0x0000001e call 00007FCA8472282Ch 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49D0E02 second address: 49D0E63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, dx 0x00000006 mov edi, 2FE9D71Eh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f jmp 00007FCA8451F692h 0x00000014 mov dword ptr [esp], ebp 0x00000017 pushad 0x00000018 mov esi, 0B2C1B3Dh 0x0000001d pushfd 0x0000001e jmp 00007FCA8451F68Ah 0x00000023 adc esi, 7ACBC518h 0x00000029 jmp 00007FCA8451F68Bh 0x0000002e popfd 0x0000002f popad 0x00000030 mov ebp, esp 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007FCA8451F695h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A50990 second address: 4A50998 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movsx ebx, cx 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A50998 second address: 4A5099E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A5099E second address: 4A509A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A509A2 second address: 4A509A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A509A6 second address: 4A509BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov esi, edi 0x0000000e mov edi, 4DB47B20h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A509BA second address: 4A509C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A509C0 second address: 4A509F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA84722830h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FCA84722837h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A509F0 second address: 4A50A22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FCA8451F68Fh 0x00000009 adc cl, 0000005Eh 0x0000000c jmp 00007FCA8451F699h 0x00000011 popfd 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A50A22 second address: 4A50A33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ebp, esp 0x00000009 pushad 0x0000000a movzx eax, bx 0x0000000d push eax 0x0000000e push edx 0x0000000f mov ah, dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A40979 second address: 4A4098B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCA8451F68Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49E07B4 second address: 49E07B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49E07B8 second address: 49E07BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49E07BE second address: 49E07C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 49E07C4 second address: 49E07C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A40E67 second address: 4A40EA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA84722839h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+08h] 0x0000000c jmp 00007FCA8472282Eh 0x00000011 push C5F096B7h 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A40EA0 second address: 4A40EA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A40EA4 second address: 4A40EAA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A40EAA second address: 4A40EB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A40EB0 second address: 4A40EB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A40EE2 second address: 4A40EE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A40EE6 second address: 4A40EEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A40EEA second address: 4A40EF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A40EF0 second address: 4A40EF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A40EF6 second address: 4A40EFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A40EFA second address: 4A40F41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 movzx eax, al 0x0000000b jmp 00007FCA84722830h 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FCA8472282Dh 0x0000001a or si, 7A06h 0x0000001f jmp 00007FCA84722831h 0x00000024 popfd 0x00000025 pushad 0x00000026 popad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A40F41 second address: 4A40F46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A2033E second address: 4A20347 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, FEFAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A20347 second address: 4A20364 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007FCA8451F68Eh 0x0000000d xchg eax, ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A20364 second address: 4A20368 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A20368 second address: 4A2036C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A2036C second address: 4A20372 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A20372 second address: 4A203C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA8451F694h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FCA8451F68Dh 0x00000014 adc al, FFFFFF86h 0x00000017 jmp 00007FCA8451F691h 0x0000001c popfd 0x0000001d call 00007FCA8451F690h 0x00000022 pop esi 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A203C4 second address: 4A203CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A203CA second address: 4A203CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A203CE second address: 4A20470 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and esp, FFFFFFF0h 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FCA84722834h 0x00000012 sub ax, B888h 0x00000017 jmp 00007FCA8472282Bh 0x0000001c popfd 0x0000001d mov ch, 68h 0x0000001f popad 0x00000020 sub esp, 44h 0x00000023 pushad 0x00000024 mov bx, F364h 0x00000028 call 00007FCA8472282Dh 0x0000002d mov cx, 8DE7h 0x00000031 pop esi 0x00000032 popad 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 pushfd 0x00000038 jmp 00007FCA84722835h 0x0000003d sbb al, 00000006h 0x00000040 jmp 00007FCA84722831h 0x00000045 popfd 0x00000046 pushfd 0x00000047 jmp 00007FCA84722830h 0x0000004c and ax, EFA8h 0x00000051 jmp 00007FCA8472282Bh 0x00000056 popfd 0x00000057 popad 0x00000058 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A20470 second address: 4A204B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA8451F699h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebx 0x0000000c pushad 0x0000000d mov bh, cl 0x0000000f popad 0x00000010 xchg eax, esi 0x00000011 jmp 00007FCA8451F692h 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a mov dx, cx 0x0000001d mov bx, cx 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A204B2 second address: 4A204B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A204B8 second address: 4A204BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A204BC second address: 4A204C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A204C0 second address: 4A204FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 jmp 00007FCA8451F693h 0x0000000e xchg eax, edi 0x0000000f jmp 00007FCA8451F696h 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A204FA second address: 4A204FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A204FE second address: 4A20502 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A20502 second address: 4A20508 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A20508 second address: 4A2051E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCA8451F692h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A2051E second address: 4A20559 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA8472282Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, edi 0x0000000c pushad 0x0000000d mov cx, 151Bh 0x00000011 jmp 00007FCA84722830h 0x00000016 popad 0x00000017 mov edi, dword ptr [ebp+08h] 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d call 00007FCA8472282Ch 0x00000022 pop eax 0x00000023 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A20559 second address: 4A20582 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 movsx edi, si 0x00000009 popad 0x0000000a mov dword ptr [esp+24h], 00000000h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FCA8451F695h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A20582 second address: 4A205A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA84722831h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lock bts dword ptr [edi], 00000000h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A205A2 second address: 4A205A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A205A6 second address: 4A205AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A205AC second address: 4A205B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A205B2 second address: 4A205B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A205B6 second address: 4A205DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA8451F68Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jc 00007FCAF72214F1h 0x00000011 pushad 0x00000012 mov ecx, 2B25F9DDh 0x00000017 push eax 0x00000018 push edx 0x00000019 mov eax, 02E53F7Fh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A205DB second address: 4A20627 instructions: 0x00000000 rdtsc 0x00000002 mov di, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edi 0x00000009 jmp 00007FCA8472282Eh 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jmp 00007FCA8472282Dh 0x00000017 pushfd 0x00000018 jmp 00007FCA84722830h 0x0000001d add eax, 5B2CA9C8h 0x00000023 jmp 00007FCA8472282Bh 0x00000028 popfd 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A20627 second address: 4A2064D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA8451F699h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d mov ecx, 57E9C379h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A2064D second address: 4A206A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushfd 0x00000008 jmp 00007FCA8472282Bh 0x0000000d adc ax, 5D6Eh 0x00000012 jmp 00007FCA84722839h 0x00000017 popfd 0x00000018 pop ecx 0x00000019 popad 0x0000001a mov esp, ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FCA84722839h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\nrKr2roAsG.exe RDTSC instruction interceptor: First address: 4A206A0 second address: 4A206B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA8451F691h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Special instruction interceptor: First address: 682C2C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Special instruction interceptor: First address: 855951 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Special instruction interceptor: First address: 8B9982 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Special instruction interceptor: First address: 3B2C2C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Special instruction interceptor: First address: 585951 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Special instruction interceptor: First address: 5E9982 instructions caused by: Self-modifying code
Contains capabilities to detect virtual machines
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Code function: 0_2_04A40E1F rdtsc 0_2_04A40E1F
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Thread delayed: delay time: 180000 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window / User API: threadDelayed 528 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window / User API: threadDelayed 1467 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window / User API: threadDelayed 1448 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7732 Thread sleep count: 46 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7732 Thread sleep time: -92046s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7736 Thread sleep count: 51 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7736 Thread sleep time: -102051s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7296 Thread sleep count: 528 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7296 Thread sleep time: -15840000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7812 Thread sleep time: -180000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7612 Thread sleep count: 44 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7612 Thread sleep time: -88044s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7616 Thread sleep count: 1467 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7616 Thread sleep time: -2935467s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7292 Thread sleep count: 1448 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7292 Thread sleep time: -2897448s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\nrKr2roAsG.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Thread delayed: delay time: 180000 Jump to behavior
Source: rapes.exe, rapes.exe, 0000000A.00000002.3659914672.0000000000540000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: rapes.exe, 0000000A.00000002.3661118709.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: nrKr2roAsG.exe, 00000000.00000002.1248130567.0000000000810000.00000040.00000001.01000000.00000003.sdmp, rapes.exe, 00000002.00000002.1273182245.0000000000540000.00000040.00000001.01000000.00000009.sdmp, rapes.exe, 0000000A.00000002.3659914672.0000000000540000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: rapes.exe, 0000000A.00000002.3661118709.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW`
Source: C:\Users\user\Desktop\nrKr2roAsG.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Thread information set: HideFromDebugger Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Code function: 0_2_04A40E1F rdtsc 0_2_04A40E1F
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 10_2_0036DB60 mov eax, dword ptr fs:[00000030h] 10_2_0036DB60
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 10_2_00375FF2 mov eax, dword ptr fs:[00000030h] 10_2_00375FF2
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\nrKr2roAsG.exe Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe "C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe" Jump to behavior
Source: rapes.exe, rapes.exe, 0000000A.00000002.3659914672.0000000000540000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Program Manager
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 10_2_00369AB5 cpuid 10_2_00369AB5
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 10_2_003693A7 GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime, 10_2_003693A7

Stealing of Sensitive Information
barindex
Yara detected Amadey
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Yara detected Amadeys Clipper DLL
Source: Yara match File source: 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.1232164142.0000000004EA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1207439914.0000000004830000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000003.1580698899.0000000004A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.3659626014.0000000000341000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.1272974657.0000000000341000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY

Remote Access Functionality
barindex
Contains functionality to start a terminal service
Source: nrKr2roAsG.exe String found in binary or memory: net start termservice
Source: nrKr2roAsG.exe, 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: net start termservice
Source: nrKr2roAsG.exe, 00000000.00000002.1248056478.0000000000611000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: nrKr2roAsG.exe, 00000000.00000003.1207439914.0000000004830000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: net start termservice
Source: nrKr2roAsG.exe, 00000000.00000003.1207439914.0000000004830000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: rapes.exe String found in binary or memory: net start termservice
Source: rapes.exe, 00000002.00000003.1232164142.0000000004EA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: net start termservice
Source: rapes.exe, 00000002.00000003.1232164142.0000000004EA0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: rapes.exe, 00000002.00000002.1272974657.0000000000341000.00000040.00000001.01000000.00000009.sdmp String found in binary or memory: net start termservice
Source: rapes.exe, 00000002.00000002.1272974657.0000000000341000.00000040.00000001.01000000.00000009.sdmp String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: rapes.exe String found in binary or memory: net start termservice
Source: rapes.exe, 0000000A.00000003.1580698899.0000000004A40000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: net start termservice
Source: rapes.exe, 0000000A.00000003.1580698899.0000000004A40000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: rapes.exe, 0000000A.00000002.3659626014.0000000000341000.00000040.00000001.01000000.00000009.sdmp String found in binary or memory: net start termservice
Source: rapes.exe, 0000000A.00000002.3659626014.0000000000341000.00000040.00000001.01000000.00000009.sdmp String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
windows-stand
Behavior
Click here to start
Slideshow Behavior Animation
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1647696 Sample: nrKr2roAsG.exe Startdate: 25/03/2025 Architecture: WINDOWS Score: 100 22 Found malware configuration 2->22 24 Antivirus detection for URL or domain 2->24 26 Antivirus / Scanner detection for submitted sample 2->26 28 8 other signatures 2->28 6 nrKr2roAsG.exe 5 2->6         started        10 rapes.exe 12 2->10         started        process3 dnsIp4 16 C:\Users\user\AppData\Local\...\rapes.exe, PE32 6->16 dropped 18 C:\Users\user\...\rapes.exe:Zone.Identifier, ASCII 6->18 dropped 30 Detected unpacking (changes PE section rights) 6->30 32 Contains functionality to start a terminal service 6->32 34 Tries to evade debugger and weak emulator (self modifying code) 6->34 36 Tries to detect virtualization through RDTSC time measurements 6->36 13 rapes.exe 6->13         started        20 176.113.115.6, 80 SELECTELRU Russian Federation 10->20 38 Hides threads from debuggers 10->38 40 Tries to detect sandboxes / dynamic malware analysis system (registry check) 10->40 42 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 10->42 file5 signatures6 process7 signatures8 44 Antivirus detection for dropped file 13->44 46 Multi AV Scanner detection for dropped file 13->46 48 Detected unpacking (changes PE section rights) 13->48 50 6 other signatures 13->50
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
176.113.115.6
 unknown Russian Federation
49505 SELECTELRU true